⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2021-12-01.

CVE-2021-42321

CWE-184CWE-502 — Deserialization of Untrusted Data11 documents9 sources
Severity
8.8HIGH
EPSS
93.6%
top 0.16%
CISA KEV
KEVRansomware
Added 2021-11-17
Due 2021-12-01
Exploit
Exploited in wild
Active exploitation observed
Affected products
5
Microsoft Microsoft Exchange Server 2016 Cumulative Update 21Microsoft Microsoft Exchange Server 2016 Cumulative Update 22Microsoft Microsoft Exchange Server 2019 Cumulative Update 10+2 more
Timeline
PublishedNov 10
KEV addedNov 17
KEV dueDec 1
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶NVDmicrosoft/exchange_server2016, 2019+1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-3f87-66x4-f3p7: Microsoft Exchange Server Remote Code Execution Vulnerability↗2022-05-24
▶
Project0
The More You Know, The More You Know You Don’t Know - Project Zero↗2022-04-01
▶
CVEList
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-11-10
▶
VulnCheck
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021
▶

🔍Detection Rules

3
Suricata
ET EXPLOIT Microsoft Exchange Delete User Configuration - xbit set 1 (CVE-2021-42321)↗2021-11-22
▶
Suricata
ET EXPLOIT Possible Microsoft Exchange Server Remote Code Execution Inbound (CVE-2021-42321)↗2021-11-22
▶
Suricata
ET EXPLOIT Microsoft Exchange Create User Configuration - xbit set 2 (CVE-2021-42321)↗2021-11-22
▶

📋Vendor Advisories

2
CISA
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-11-17
▶
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-11-09
▶