Microsoft · Exchange Server
CVE-2021-31196
Microsoft Exchange Server Remote Code Execution Vulnerability
Exploited in attacks
High 7.2 Attack chance: 54%
What it is
Microsoft Exchange Server Remote Code Execution Vulnerability
CISA: Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: September 11, 2024
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 13, 2026 | Deserialization of Untrusted Data | Exchange Server | High 8.8 | 59% |
| Feb 15, 2024 | Privilege Escalation | Exchange Server | Critical 9.8 | 13% |
| Jan 10, 2023 | Privilege Escalation | Exchange Server | High 8.8 | 77% |
| Sep 30, 2022 | Server-Side Request Forgery | Exchange Server | High 8.8 | >99.9% |
| Sep 30, 2022 | Remote Code Execution | Exchange Server | High 8.0 | >99.9% |
| Mar 3, 2022 | Privilege Escalation | Exchange Server | High 7.4 | 27% |
| Jan 18, 2022 | Information Disclosure | Exchange Server | High 7.3 | 98% |
| Nov 3, 2021 | Validation Key Remote Code Execution | Exchange Server | High 8.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.