7.2
High
Exploited
CVE-2021-31196 Microsoft Exchange Server Information Disclosure Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Description
Microsoft Exchange Server Remote Code Execution Vulnerability
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Exchange Server 2019 Cumulative Update 9 15.02 | 15.02.0 → < 15.02.0858.015 | 15.02.0858.015 |
| Microsoft Exchange Server 2016 Cumulative Update 20 15.01 | 15.01.0 → < 15.01.2242.012 | 15.01.2242.012 |
| Microsoft Exchange Server 2013 Cumulative Update 23 15.00 | 15.00.0 → < 15.00.1497.023 | 15.00.1497.023 |
| Microsoft Exchange Server 2016 Cumulative Update 21 15.01 | 15.01.0 → < 15.01.2308.014 | 15.01.2308.014 |
| Microsoft Exchange Server 2019 Cumulative Update 10 15.02 | 15.02.0 → < 15.02.0922.013 | 15.02.0922.013 |
References
- Microsoft Exchange Server Remote Code Execution Vulnerability msrc.microsoft.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Microsoft Exchange Server 2019 Cumulative Update 9
The 14 CVEs of Microsoft Exchange Server 2019 Cumulative Update 9 →
CVE-2021-34523
Microsoft Exchange Server Privilege Escalation Vulnerability
9.0
Critical
CVE-2021-34473
Microsoft Exchange Server Remote Code Execution Vulnerability
9.1
Critical
CVE-2021-33768
Microsoft Exchange Server Elevation of Privilege Vulnerability
8.0
High
CVE-2021-33766
Microsoft Exchange Server Information Disclosure
7.3
High