{"id":"CVE-2021-42321","kind":"vulnerability","aliases":["CVE-2021-42321"],"related":[],"title":"Microsoft Exchange: Microsoft Exchange Server Remote Code Execution Vulnerability","description":"An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Exchange Server has a flaw in how it validates cmdlet arguments, letting an authenticated user run code on the server. The flaw is confirmed exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.","severity":"high","cvss":8.8,"epss":0.91737,"exploited":true,"exploited_at":"2021-11-17T00:00:00+00:00","products":[{"name":"Microsoft Exchange","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exchange","exploited","on-premises","ransomware","vendor","windows"],"not_affected_if":["exchange-online","no-exchange-server"],"how_to_check":null,"fix":"Apply the Microsoft updates for Exchange Server per vendor instructions (CISA required action); the specific cumulative update versions are not in the sources.","status":"open","published_at":"2021-11-10T01:19:50+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:01+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:32:01Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Exchange Server per vendor instructions (CISA required action); the specific cumulative update versions are not in the sources.","reach":"network","impact":"high","summary":"Microsoft Exchange Server has a flaw in how it validates cmdlet arguments, letting an authenticated user run code on the server. The flaw is confirmed exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.","category":"vendor","who_cares":["exchange","on-premises","windows"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs code on the Exchange server with an authenticated account","analyst_note":"Find the affected and fixed Exchange builds and the mitigation steps at the Microsoft security response entry for CVE-2021-42321 (msrc.microsoft.com) and check the Exchange Server version list there.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["exchange-online","no-exchange-server"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00048,"input_tokens":2832,"output_tokens":393,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Exchange builds and the mitigation steps at the Microsoft security response entry for CVE-2021-42321 (msrc.microsoft.com) and check the Exchange Server version list there.","search":"'-2021':11A,14A '-42321':12A,15A 'action':85C 'appli':86C 'argument':37B,74C 'attack':67C 'authent':40B,66C 'catalog':64B 'cisa':59B,83C 'cmdlet':36B,73C 'code':7A,43B,81C 'confirm':50B 'could':68C 'cve':10A,13A 'exchang':2A,4A,18B,27B,77C 'exchange':17A 'execut':8A,82C 'exploit':19B,51B,62B 'flaw':31B,48B 'improp':70C 'instruct':90C 'known':61B 'let':38B 'leverag':69C 'list':57B 'microsoft':1A,3A,16A,26B,76C 'on-premis':20B 'per':88C 'perform':79C 'premis':22B 'ransomwar':23B 'remot':6A,80C 'requir':84C 'run':42B 'server':5A,28B,46B 'updat':87C 'user':41B 'valid':35B,71C 'vendor':24B,89C 'vulner':9A,63B 'wild':54B 'window':25B 'within':75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-11-10T01:19:50+00:00","kev":{"dateAdded":"2021-11-17","dueDate":"2021-12-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-42321","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42321","severity":null,"published_at":"2021-11-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2021-42321","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-42321","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-42321","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42321","severity":null,"published_at":"2021-11-10T01:19:50+00:00","modified_at":"2026-08-19T19:23:07+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}