{"id":"CVE-2021-34523","published":"2021-07-14T18:15:12Z","modified":"2026-08-10T19:59:11Z","title":"Microsoft Exchange Server Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Exchange Server","tier":"core","eol":null,"description":{"text":"Microsoft Exchange Server Elevation of Privilege Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The privilege escalation flaw lies in Microsoft Exchange Server, in its elevation of privilege component, stemming from improper authentication. An attacker with local access to the system can escalate privileges with no authentication or user interaction required, gaining high confidentiality and integrity impact.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:53:55Z"},"cvss":{"score":9.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.9999,"percentile":0.99985,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34523","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-08-30","exploitedFirstSeen":"2021-08-30","ransomware":true,"evidence":[{"url":"https://www.cybereason.com/blog/threat-alert-microsoft-exchange-proxyshell-exploits-and-lockfile-ransomware","date":"2021-08-30"},{"url":"https://www.fireeye.com/blog/threat-research/2021/09/proxyshell-exploiting-microsoft-exchange-servers.html","date":"2021-09-03"},{"url":"https://www.securin.io/microsoft-exchange-proxyshell-and-windows-petitpotam-vulnerabilities-chained-in-new-attack/","date":"2021-09-15"},{"url":"https://threatpost.com/apt-chamelgang-targets-russian-energy-aviation/175272/","date":"2021-10-01"},{"url":"https://news.sophos.com/en-us/2021/10/04/atom-silo-ransomware-actors-use-confluence-exploit-dll-side-load-for-stealthy-attack/","date":"2021-10-04"},{"url":"https://threatpost.com/tortilla-exchange-servers-proxyshell/175967/","date":"2021-11-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/csw_final_ransomware_index-update-q321-csw_.pdf","date":"2021-11-10"},{"url":"https://blog.cyble.com/2022/01/17/avoslocker-ransomware-linux-version-targets-vmware-esxi-servers/","date":"2022-01-17"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf","date":"2022-01-26"}],"evidenceTotal":112,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34523","tags":["Patch","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-822/","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34523","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","report-attack-id","report-passage"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation; ATT&CK ID T1190 introduces a list containing CVE-2021-34523; ATT&CK ID T1190 written in the same sentence as CVE-2021-34523; keyword query KW:T1190:2","mappingType":"exploitation_technique","evidence":[{"reportId":"SRC-58d99d8240c0597214b0","quote":"the following vulnerabilities against Microsoft Exchange servers [T1190]:\nCVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability\nCVE-2021-34473 - Microsoft Exchange Server Remote Code Execution Vulnerability\nCVE-2021-34523 - Microsoft Exchange Server Privilege Escalation","start":3320,"end":3617},{"reportId":"SRC-f094fce42fddf5f29cd2","quote":"BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.","start":3973,"end":4172},{"reportId":"SRC-f5b6ae14f78161a4d74c","quote":"Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).","start":57,"end":272}],"comment":"This privilege escalation vulnerability can be exploited by sending a specially crafted HTTP request to the exchange server, is it often chained together with CVE-2021-34473, a remote code execution vulnerability.","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"machine","basis":"dataset-annotation","bases":["dataset-annotation"],"basisDetail":"TRAM2 annotated sentence label","mappingType":null,"evidence":[{"reportId":"SRC-3bd87bcc3ec7ea8da0e5","quote":"ion for Privilege Escalation\nThe ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.","start":9621,"end":9941}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-55c3db7cc26d9cd5018b","title":"The five-day job: A BlackByte ransomware intrusion case study","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/","date":"2023-07-06","mentions":[{"quote":"To obtain initial access into the victim’s environment, the threat actor was observed exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers.","start":2873,"end":3092},{"quote":"CVE-2021-34523","start":19193,"end":19207}]},{"id":"SRC-f5b6ae14f78161a4d74c","title":"Blackcat","publisher":"blog.group-ib.com","url":"https://blog.group-ib.com/blackcat","date":null,"mentions":[{"quote":"Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).","start":57,"end":272}]},{"id":"SRC-f094fce42fddf5f29cd2","title":"TTPs used by BlackByte Ransomware Targeting Critical Infrastructure","publisher":"picussecurity.com","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure","date":null,"mentions":[{"quote":"The ransomware threat actors scan the network of their targets and check whether the network has CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 vulnerabilities.","start":3744,"end":3908},{"quote":"BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.","start":3973,"end":4172},{"quote":"CVE-2021-34523","start":4424,"end":4438}]},{"id":"SRC-e030a140d352155c7a50","title":"RaaS AvosLocker Incident Response Analysis","publisher":"linkedin.com","url":"https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory","date":null,"mentions":[{"quote":"CVEs involved in these exploits are CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207.","start":1949,"end":2052}]},{"id":"SRC-db754fc6f8e3b44fee8e","title":"People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a","date":null,"mentions":[{"quote":"APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J (CVE-2021-44228), Atlassian Confluence (CVE-2021-31207, CVE-2021-26084) and Microsoft Exchange (CVE-2021-31207, CVE-2021-34523, CVE-2021-34473).","start":3713,"end":3947}]},{"id":"SRC-63da12bf8b0e9f1434a5","title":"2022OverWatchThreatHuntingReport","publisher":"go.crowdstrike.com","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf","date":null,"mentions":[{"quote":"https:/ /msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523.","start":39597,"end":39667}]},{"id":"SRC-5a1fc38d97e601a01ee4","title":"Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool","publisher":"security.com","url":"https://www.security.com:443/threat-intelligence/blackbyte-exbyte-ransomware","date":null,"mentions":[{"quote":"In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.","start":2846,"end":3112}]},{"id":"SRC-58d99d8240c0597214b0","title":"#StopRansomware: Hive Ransomware","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a","date":null,"mentions":[{"quote":"the following vulnerabilities against Microsoft Exchange servers [T1190]:\nCVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability\nCVE-2021-34473 - Microsoft Exchange Server Remote Code Execution Vulnerability\nCVE-2021-34523 - Microsoft Exchange Server Privilege Escalation","start":3320,"end":3617},{"quote":"Hive actors gain access to victim network by exploiting the following Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-42321.","start":9678,"end":9847}]},{"id":"SRC-3bd87bcc3ec7ea8da0e5","title":"LockBit 2.0: How This RaaS Operates and How to Protect Against It","publisher":"unit42.paloaltonetworks.com","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/","date":null,"mentions":[{"quote":"The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.","start":9650,"end":9941}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-21177","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21177","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2021-10-02","earliestUrl":"https://github.com/mithridates1313/ProxyShell_POC","repos":[{"name":"mithridates1313/ProxyShell_POC","url":"https://github.com/mithridates1313/ProxyShell_POC","stars":16,"created":"2021-10-02"},{"name":"SUPRAAA-1337/CVE-2021-34523","url":"https://github.com/SUPRAAA-1337/CVE-2021-34523","stars":2,"created":"2023-09-02"}]},"metasploit":[{"name":"Microsoft Exchange ProxyShell RCE","module":"exploit/windows/http/exchange_proxyshell_rce","type":"exploit","disclosureDate":"2021-04-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb"}],"first":{"date":"2021-04-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"observed","techniques":["T1068"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2021-04-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-10-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb","provenance":"source"},{"date":"2021-07-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34523","provenance":"source"},{"date":"2021-08-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cybereason.com/blog/threat-alert-microsoft-exchange-proxyshell-exploits-and-lockfile-ransomware","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-21177","provenance":"source"},{"date":"2023-07-06","kind":"report","label":"Named in microsoft.com: The five-day job: A BlackByte ransomware intrusion case study","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":112},"priority":{"score":89.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1886 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":10.0,"detail":"9 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-exchange-server-cwe-287"}}