Microsoft · Exchange Server
CVE-2021-33766
Microsoft Exchange Server Information Disclosure Vulnerability
Exploited in attacks
High 7.3 Attack chance: 98%
What it is
Microsoft Exchange Server Information Disclosure Vulnerability
CISA: Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: February 1, 2022
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 13, 2026 | Deserialization of Untrusted Data | Exchange Server | High 8.8 | 59% |
| Aug 21, 2024 | Information Disclosure | Exchange Server | High 7.2 | 54% |
| Feb 15, 2024 | Privilege Escalation | Exchange Server | Critical 9.8 | 13% |
| Jan 10, 2023 | Privilege Escalation | Exchange Server | High 8.8 | 77% |
| Sep 30, 2022 | Server-Side Request Forgery | Exchange Server | High 8.8 | >99.9% |
| Sep 30, 2022 | Remote Code Execution | Exchange Server | High 8.0 | >99.9% |
| Mar 3, 2022 | Privilege Escalation | Exchange Server | High 7.4 | 27% |
| Nov 3, 2021 | Validation Key Remote Code Execution | Exchange Server | High 8.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.