---
id: "CVE-2024-21410"
kind: "vulnerability"
aliases: ["CVE-2024-21410"]
title: "Microsoft Exchange Server Elevation of Privilege Vulnerability"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Exchange Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "microsoft exchange server", "fixed": [], "affected": "= 2016", "ecosystem": "vendor"}, {"name": "microsoft exchange server", "fixed": [], "affected": "= 2019", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exchange-server", "exploited", "infrastructure", "on-premises-exchange", "windows"]
not_affected_if: ["exchange-online"]
published_at: "2024-02-13T18:15:59+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-21410", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21410", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server has a privilege escalation flaw that attackers are actively exploiting in the wild, per CISA's Known Exploited Vulnerabilities catalog. The sources do not describe the exact entry point or what the escalated privileges grant beyond general privilege escalation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Exchange Server affected ? fixed ?
- vendor:microsoft exchange server affected = 2016 fixed ?
- vendor:microsoft exchange server affected = 2019 fixed ?

## Fix

Apply the mitigations or patches from Microsoft's vendor advisory for CVE-2024-21410; CISA says to discontinue use of the product if mitigations are unavailable.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-21410
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-21410

## From the sources

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_