CVE-2021-33768
published 2021-07-14CVE-2021-33768: Microsoft Exchange Server Elevation of Privilege Vulnerability
PriorityP278high8CVSS 3.1
AVAACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.23%
68.8th percentile
Microsoft Exchange Server Elevation of Privilege Vulnerability
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | microsoft_exchange_server_2016_cumulative_update_20 | >= 15.01.0 < 15.01.2242.012 | 15.01.2242.012 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_21 | >= 15.01.0 < 15.01.2308.014 | 15.01.2308.014 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_10 | >= 15.02.0 < 15.02.0922.013 | 15.02.0922.013 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_9 | >= 15.02.0 < 15.02.0858.015 | 15.02.0858.015 |
| msrc | microsoft_exchange_server_2016_cumulative_update_20 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_21 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_10 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_9 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attack vector is Adjacent (AV:A), meaning exploitation requires the attacker to be on the same logical or physical network segment as the target Exchange Server — not exploitable directly over the open internet. ↗
- →Exploitation requires man-in-the-middle type setup or prior foothold in an adjacent network environment; monitor for anomalous lateral movement or ARP/network spoofing activity targeting Exchange Server hosts. ↗
- →Impact is Elevation of Privilege on Microsoft Exchange Server; monitor Exchange Server processes and service accounts for unexpected privilege escalation events. ↗
- ·Exploit status is 'Exploitation Less Likely' for both latest and older software releases, and has not been publicly disclosed or exploited in the wild as of the advisory date. ↗
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.2MEDIUMAV:A/AC:L/Au:S/C:P/I:P/A:P
vulncheck8.0HIGH
vendor_msrc8.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Exchange Server Elevation of Privilege Vulnerability
vendor_msrc·2021-07-13·CVSS 8.0
CVE-2021-33768 [HIGH] Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
FAQ: According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?
This vulnerability's attack is limited at the protocol level to a logically adjacent topology. This means it cannot simply be done across the internet, but instead needs something specific tied to the target. Good examples would include the same shared physical network (such as Bluetooth or IEEE 802.11), logical network (local IP subnet), or from within a secure or otherwise limited administrative domain (MPLS, secure VPN to an administrative network zone). This is common to many attacks that require man-in-the-middle type setups or that rely on initially gaining a foothold in another environment.
Microsoft Exc
VulDB
Microsoft Exchange Server up to 2019 CU10 privilege escalation
vuldb·2026-08-11·CVSS 8.0
CVE-2021-33768 [HIGH] Microsoft Exchange Server up to 2019 CU10 privilege escalation
A vulnerability, which was classified as critical, has been found in Microsoft Exchange Server 2013 CU23/2016 CU20/2016 CU21/2019 CU9/2019 CU10. Affected is an unknown function. The manipulation leads to privilege escalation.
This vulnerability is traded as CVE-2021-33768. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to install a patch to address this issue.
GHSA
GHSA-gcrr-725q-f8jw: Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34470
ghsa_unreviewed·2022-05-24·CVSS 8.0
CVE-2021-34523 [HIGH] CWE-269 GHSA-gcrr-725q-f8jw: Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34470
Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34470.
GHSA
GHSA-79w4-597w-fxxx: Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-34470, CVE-2021-34523
ghsa_unreviewed·2022-05-24·CVSS 8.0
CVE-2021-33768 [HIGH] CWE-269 GHSA-79w4-597w-fxxx: Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-34470, CVE-2021-34523
Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-34470, CVE-2021-34523.
GHSA
GHSA-hxhm-28wc-v3qm: Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34523
ghsa_unreviewed·2022-05-24·CVSS 8.0
CVE-2021-34470 [HIGH] CWE-269 GHSA-hxhm-28wc-v3qm: Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34523
Microsoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33768, CVE-2021-34523.
VulnCheck
Microsoft Exchange Server Privilege Escalation
vulncheck·2021·CVSS 8.0
CVE-2021-33768 [HIGH] Microsoft Exchange Server Privilege Escalation
Microsoft Exchange Server Privilege Escalation
Microsoft Exchange Server Elevation of Privilege Vulnerability
Affected: Microsoft Exchange Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://cisa.gov/news-events/cybersecurity-advisories/aa22-257a; https://www.hhs.gov/sites/default/files/iranian-threat-actors-and-healthcare.pdf
No detection rules found.
No public exploits indexed.
Tenable
AA22-257A: Cybersecurity Agencies Issue Joint Advisory on Iranian Islamic Revolutionary Guard Corps-Affiliated Attacks
blogs_tenable·2022-09-15
AA22-257A: Cybersecurity Agencies Issue Joint Advisory on Iranian Islamic Revolutionary Guard Corps-Affiliated Attacks
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Microsoft’s July 2021 Patch Tuesday Includes 116 CVEs (CVE-2021-31979, CVE-2021-33771)
blogs_tenable·2021-07-13·CVSS 7.8
[HIGH] Microsoft’s July 2021 Patch Tuesday Includes 116 CVEs (CVE-2021-31979, CVE-2021-33771)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Crowdstrike
July 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] July 2021 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Crowdstrike
July 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] July 2021 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2021-07-14
Published
Exploited in the wild