Microsoft · Exchange Server
CVE-2021-31207
Microsoft Exchange Server Security Feature Bypass Vulnerability
Exploited in attacks
Used by ransomware
Medium 6.6 Attack chance: 99.8%
What it is
Microsoft Exchange Server Security Feature Bypass Vulnerability
CISA: Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: November 17, 2021
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 13, 2026 | Deserialization of Untrusted Data | Exchange Server | High 8.8 | 59% |
| Aug 21, 2024 | Information Disclosure | Exchange Server | High 7.2 | 54% |
| Feb 15, 2024 | Privilege Escalation | Exchange Server | Critical 9.8 | 13% |
| Jan 10, 2023 | Privilege Escalation | Exchange Server | High 8.8 | 77% |
| Sep 30, 2022 | Server-Side Request Forgery | Exchange Server | High 8.8 | >99.9% |
| Sep 30, 2022 | Remote Code Execution | Exchange Server | High 8.0 | >99.9% |
| Mar 3, 2022 | Privilege Escalation | Exchange Server | High 7.4 | 27% |
| Jan 18, 2022 | Information Disclosure | Exchange Server | High 7.3 | 98% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.