---
id: "CVE-2021-42321"
kind: "vulnerability"
aliases: ["CVE-2021-42321"]
title: "Microsoft Exchange: Microsoft Exchange Server Remote Code Execution Vulnerability"
severity: "high"
cvss: 8.8
epss: 0.91737
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Microsoft Exchange", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exchange", "exploited", "on-premises", "ransomware", "vendor", "windows"]
not_affected_if: ["exchange-online", "no-exchange-server"]
published_at: "2021-11-10T01:19:50+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42321", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-42321", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42321", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Exchange: Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server has a flaw in how it validates cmdlet arguments, letting an authenticated user run code on the server. The flaw is confirmed exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Exchange affected ? fixed ?

## Fix

Apply the Microsoft updates for Exchange Server per vendor instructions (CISA required action); the specific cumulative update versions are not in the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-42321
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-42321
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-42321

## From the sources

An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_