{"id":"CVE-2021-34473","published":"2021-07-14T18:15:11Z","modified":"2026-08-10T19:58:52Z","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Exchange Server","tier":"core","eol":null,"description":{"text":"Microsoft Exchange Server Remote Code Execution Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"Microsoft Exchange Server contains a remote code execution vulnerability classified as Server-Side Request Forgery (CWE), which lies in the server's handling of request processing. An unauthenticated attacker with network access to the Exchange Server can exploit it without any user interaction or non-default configuration, potentially gaining high confidentiality and integrity impact on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:08Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99996,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34473","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-08-30","exploitedFirstSeen":"2021-08-30","ransomware":true,"evidence":[{"url":"https://www.cybereason.com/blog/threat-alert-microsoft-exchange-proxyshell-exploits-and-lockfile-ransomware","date":"2021-08-30"},{"url":"https://www.fireeye.com/blog/threat-research/2021/09/proxyshell-exploiting-microsoft-exchange-servers.html","date":"2021-09-03"},{"url":"https://www.securin.io/microsoft-exchange-proxyshell-and-windows-petitpotam-vulnerabilities-chained-in-new-attack/","date":"2021-09-15"},{"url":"https://threatpost.com/apt-chamelgang-targets-russian-energy-aviation/175272/","date":"2021-10-01"},{"url":"https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/","date":"2021-10-04"},{"url":"https://threatpost.com/tortilla-exchange-servers-proxyshell/175967/","date":"2021-11-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/csw_final_ransomware_index-update-q321-csw_.pdf","date":"2021-11-10"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa21-321a","date":"2021-11-17"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa21-321a","date":"2021-11-19"}],"evidenceTotal":1017,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473","tags":["Patch","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-821/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34473","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","report-attack-id","report-passage"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution; ATT&CK ID T1190 introduces a list containing CVE-2021-34473; ATT&CK ID T1190 written in the same sentence as CVE-2021-34473; keyword query KW:T1190:2","mappingType":"exploitation_technique","evidence":[{"reportId":"SRC-58d99d8240c0597214b0","quote":"distributing phishing emails with malicious attachments [T1566.001] and by exploiting the following vulnerabilities against Microsoft Exchange servers [T1190]:\nCVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability\nCVE-2021-34473 - Microsoft Exchange Server Remote Code Execution","start":3234,"end":3539},{"reportId":"SRC-f094fce42fddf5f29cd2","quote":"BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.","start":3973,"end":4172},{"reportId":"SRC-f5b6ae14f78161a4d74c","quote":"Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).","start":57,"end":272}],"comment":"This is a remote code execution vulnerability that is often chained with CVE-2021-34523, a privilege escalation vulnerability.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1136","name":"Create Account","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-55c3db7cc26d9cd5018b","title":"The five-day job: A BlackByte ransomware intrusion case study","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/","date":"2023-07-06","mentions":[{"quote":"To obtain initial access into the victim’s environment, the threat actor was observed exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers.","start":2873,"end":3092},{"quote":"CVE-2021-34473","start":19175,"end":19189}]},{"id":"SRC-f5b6ae14f78161a4d74c","title":"Blackcat","publisher":"blog.group-ib.com","url":"https://blog.group-ib.com/blackcat","date":null,"mentions":[{"quote":"Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).","start":57,"end":272}]},{"id":"SRC-f094fce42fddf5f29cd2","title":"TTPs used by BlackByte Ransomware Targeting Critical Infrastructure","publisher":"picussecurity.com","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure","date":null,"mentions":[{"quote":"The ransomware threat actors scan the network of their targets and check whether the network has CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 vulnerabilities.","start":3744,"end":3908},{"quote":"BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.","start":3973,"end":4172},{"quote":"CVE-2021-34473","start":4323,"end":4337}]},{"id":"SRC-e030a140d352155c7a50","title":"RaaS AvosLocker Incident Response Analysis","publisher":"linkedin.com","url":"https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory","date":null,"mentions":[{"quote":"CVEs involved in these exploits are CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207.","start":1949,"end":2052}]},{"id":"SRC-db754fc6f8e3b44fee8e","title":"People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a","date":null,"mentions":[{"quote":"APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).","start":3713,"end":3947}]},{"id":"SRC-63da12bf8b0e9f1434a5","title":"2022OverWatchThreatHuntingReport","publisher":"go.crowdstrike.com","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf","date":null,"mentions":[{"quote":"(CVE-2021-34473,8 CVE-2021-345239 and CVE-2021-3120710) are","start":38907,"end":38966},{"quote":"https:/ /msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473.","start":39473,"end":39543}]},{"id":"SRC-5a1fc38d97e601a01ee4","title":"Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool","publisher":"security.com","url":"https://www.security.com:443/threat-intelligence/blackbyte-exbyte-ransomware","date":null,"mentions":[{"quote":"In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.","start":2846,"end":3112}]},{"id":"SRC-58d99d8240c0597214b0","title":"#StopRansomware: Hive Ransomware","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a","date":null,"mentions":[{"quote":"distributing phishing emails with malicious attachments [T1566.001] and by exploiting the following vulnerabilities against Microsoft Exchange servers [T1190]:\nCVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability\nCVE-2021-34473 - Microsoft Exchange Server Remote Code Execution","start":3234,"end":3539},{"quote":"Hive actors gain access to victim network by exploiting the following Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-42321.","start":9678,"end":9847}]},{"id":"SRC-3bd87bcc3ec7ea8da0e5","title":"LockBit 2.0: How This RaaS Operates and How to Protect Against It","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/","date":null,"mentions":[{"quote":"Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028) have been observed being utilized as footholds into the environment.","start":8399,"end":8566}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-21128","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21128","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":9,"skipped":0,"earliest":"2021-08-10","earliestUrl":"https://github.com/cyberheartmi9/Proxyshell-Scanner","repos":[{"name":"horizon3ai/proxyshell","url":"https://github.com/horizon3ai/proxyshell","stars":121,"created":"2021-09-04"},{"name":"cyberheartmi9/Proxyshell-Scanner","url":"https://github.com/cyberheartmi9/Proxyshell-Scanner","stars":46,"created":"2021-08-10"},{"name":"kh4sh3i/ProxyShell","url":"https://github.com/kh4sh3i/ProxyShell","stars":43,"created":"2022-06-29"},{"name":"p2-98/CVE-2021-34473","url":"https://github.com/p2-98/CVE-2021-34473","stars":30,"created":"2021-08-16"},{"name":"je6k/CVE-2021-34473-Exchange-ProxyShell","url":"https://github.com/je6k/CVE-2021-34473-Exchange-ProxyShell","stars":16,"created":"2021-11-22"}]},"metasploit":[{"name":"Microsoft Exchange ProxyShell RCE","module":"exploit/windows/http/exchange_proxyshell_rce","type":"exploit","disclosureDate":"2021-04-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb"}],"nuclei":[{"id":"CVE-2021-34473","name":"Exchange Server - Remote Code Execution","severity":"critical","path":"http/cves/2021/CVE-2021-34473.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34473.yaml"}],"first":{"date":"2021-04-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1053.005"],"provenance":"source"},{"stage":"secondary","techniques":["T1136","T1048.003","T1486"],"provenance":"source"}],"timeline":[{"date":"2021-04-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-08-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb","provenance":"source"},{"date":"2021-07-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34473","provenance":"source"},{"date":"2021-08-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cybereason.com/blog/threat-alert-microsoft-exchange-proxyshell-exploits-and-lockfile-ransomware","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21128","provenance":"source"},{"date":"2023-07-06","kind":"report","label":"Named in microsoft.com: The five-day job: A BlackByte ransomware intrusion case study","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":112},"priority":{"score":89.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1887 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":10.0,"detail":"9 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 9 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-exchange-server-cwe-918"}}