Skip to content
Back to search

CVE-2021-34523

CRITICAL
9.0 RansomwareNVD

Summary

generated automatically from NVD data

CVE-2021-34523 is an elevation of privilege vulnerability in Microsoft Exchange Server, affecting versions 2013, 2016 and 2019 according to NVD data. The description gives no further technical detail, but the CVSS v3.1 vector indicates a local attack with low complexity, no privileges and no user interaction, with a changed scope and high impact on confidentiality and integrity. It is rated CRITICAL with a score of 9.0, and it is listed in the CISA KEV catalog (added 2021-11-03) with known use in ransomware campaigns.

NVD description

Microsoft Exchange Server Elevation of Privilege Vulnerability

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2021-11-17

Used in known ransomware campaigns.

EPSS · FIRST.org

100.0%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

9.0
/ 10.0
CRITICAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Information

Published
14 juil. 2021
Updated
10 août 2026
Status
Analyzed
Source
secure@microsoft.com

Affected products

microsoft exchange server
Versions : 2013, 2016, 2019

Weaknesses (CWE)

NVD-CWE-noinfo

References (5)

Similar CVEs

Other vulnerabilities of type

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring