{"id":"CVE-2021-31196","kind":"vulnerability","aliases":["CVE-2021-31196"],"related":[],"title":"Microsoft Exchange Server Remote Code Execution Vulnerability","description":"Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Microsoft Exchange Server has an information disclosure flaw that CISA lists as known exploited. The description also says it allows remote code execution, so the sources conflict on impact.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2024-08-21T00:00:00+00:00","products":[{"name":"Microsoft Exchange Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft exchange server","fixed":[],"affected":"= 2013","ecosystem":"vendor"},{"name":"microsoft exchange server","fixed":[],"affected":"= 2016","ecosystem":"vendor"},{"name":"microsoft exchange server","fixed":[],"affected":"= 2019","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exchange-server","exploited","microsoft","self-hosted","vendor"],"not_affected_if":["exchange-online","unknown"],"how_to_check":null,"fix":"Apply the Microsoft mitigations per vendor instructions, or stop using the product if mitigations are unavailable (per CISA required action).","status":"open","published_at":"2021-07-14T18:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:21+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-23T20:58:21Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft mitigations per vendor instructions, or stop using the product if mitigations are unavailable (per CISA required action).","reach":"internet","impact":"high","summary":"Microsoft Exchange Server has an information disclosure flaw that CISA lists as known exploited. The description also says it allows remote code execution, so the sources conflict on impact.","category":"vendor","who_cares":["exchange-server","microsoft","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker may read data or run code on the Exchange server; sources conflict","analyst_note":"Confirm affected and fixed Exchange versions and the exact vendor mitigation from the Microsoft advisory for CVE-2021-31196, and resolve whether the flaw is info disclosure or RCE.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["exchange-online","unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000464,"input_tokens":2801,"output_tokens":367,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':9A,12A '-31196':10A,13A 'action':80C 'allow':54B,73C 'also':51B 'appli':81C 'cisa':44B,78C 'code':5A,56B,76C 'conflict':61B 'contain':67C 'cve':8A,11A 'descript':50B 'disclosur':41B,70C 'discontinu':87C 'exchang':2A,27B,36B,65C 'exchange':15A,18A,21A,24A 'exchange-serv':26B 'execut':6A,57B,77C 'exploit':29B,48B 'flaw':42B 'host':33B 'impact':63B 'inform':40B,69C 'instruct':85C 'known':47B 'list':45B 'microsoft':1A,14A,17A,20A,23A,30B,35B,64C 'mitig':82C,93C 'per':83C 'product':91C 'remot':4A,55B,75C 'requir':79C 'say':52B 'self':32B 'self-host':31B 'server':3A,16A,19A,22A,25A,28B,37B,66C 'sourc':60B 'unavail':95C 'use':88C 'vendor':34B,84C 'vulner':7A,71C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-07-14T18:15:09+00:00","kev":{"dateAdded":"2024-08-21","dueDate":"2024-09-11","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-31196","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31196","severity":null,"published_at":"2024-08-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-31196","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31196","severity":null,"published_at":"2021-07-14T18:15:09+00:00","modified_at":"2026-08-10T19:58:38+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}