{"id":"CVE-2021-31207","kind":"vulnerability","aliases":["CVE-2021-31207"],"related":[],"title":"Microsoft Exchange Server: Microsoft Exchange Server Security Feature Bypass Vulnerability","description":"Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Exchange Server has a security feature bypass flaw that CISA lists as exploited in the wild, and ransomware use is tagged. The sources do not describe exactly what the bypass grants, so the worst case below is inferred from the ProxyLogon-era chain it belongs to, not stated.","severity":"medium","cvss":6.6,"epss":0.99782,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Exchange Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exchange-server","exploited","infrastructure","on-premises","ransomware","windows"],"not_affected_if":["exchange-online","microsoft-365"],"how_to_check":"Check the installed Exchange build version against Microsoft's security update list for CVE-2021-31207 (sources do not give a command).","fix":"Apply the Microsoft Exchange Server security update for CVE-2021-31207 per vendor instructions (CISA required action); exact fixed build unknown from sources.","status":"open","published_at":"2021-05-11T19:15:10+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:26+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:37:26Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft Exchange Server security update for CVE-2021-31207 per vendor instructions (CISA required action); exact fixed build unknown from sources.","reach":"internet","impact":"high","summary":"Microsoft Exchange Server has a security feature bypass flaw that CISA lists as exploited in the wild, and ransomware use is tagged. The sources do not describe exactly what the bypass grants, so the worst case below is inferred from the ProxyLogon-era chain it belongs to, not stated.","category":"infrastructure","who_cares":["exchange-server","on-premises","windows"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; attacker bypasses a security feature on the mail server","analyst_note":"Sources do not state the bypass mechanism, auth needs, or fixed build; check Microsoft's CVE-2021-31207 advisory and the CISA KEV entry for specifics.","how_to_check":"Check the installed Exchange build version against Microsoft's security update list for CVE-2021-31207 (sources do not give a command).","needs_analyst":true,"not_affected_if":["exchange-online","microsoft-365"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000506,"input_tokens":2827,"output_tokens":446,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':12A,15A '-31207':13A,16A 'action':95C 'allow':88C 'appli':96C 'belong':76B 'bypass':9A,37B,60B,92C 'case':65B 'chain':74B 'cisa':40B,93C 'contain':83C 'cve':11A,14A 'describ':56B 'era':73B 'exact':57B 'exchang':2A,5A,21B,31B,81C 'exchange':18A 'exchange-serv':20B 'exploit':23B,43B 'featur':8A,36B,91C 'flaw':38B 'grant':61B 'infer':68B 'infrastructur':24B 'instruct':100C 'list':41B 'microsoft':1A,4A,17A,30B,80C 'on-premis':25B 'per':98C 'premis':27B 'proxylogon':72B 'proxylogon-era':71B 'ransomwar':28B,48B 'requir':94C 'secur':7A,35B,90C 'server':3A,6A,19A,22B,32B,82C 'sourc':53B 'state':79B 'tag':51B 'unspecifi':85C 'updat':97C 'use':49B 'vendor':99C 'vulner':10A,86C 'wild':46B 'window':29B 'worst':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-11T19:15:10+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-31207","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-31207","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:50+00:00","note":null},{"source":"epss","external_id":"CVE-2021-31207","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31207","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-31207","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31207","severity":null,"published_at":"2021-05-11T19:15:10+00:00","modified_at":"2026-06-17T03:51:27+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}