CVE-2021-28480: Microsoft Exchange Server remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction exploitation and a very high EPSS score make this a top-priority patch despite the thin description.

What it is

CVE-2021-28480 is a remote code execution flaw in Microsoft Exchange Server. The record gives only a generic description and no root-cause detail, so the exact vulnerable component is not stated. A critical-severity RCE in Exchange matters because the server is internet-facing and compromise can give an attacker control of the mail infrastructure.

Impact

An unauthenticated remote attacker can execute arbitrary code on the Exchange server, with high impact to confidentiality, integrity and availability. That typically means full control of the host and access to mail data and credentials.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction, so exploitation is remote and unauthenticated. The record does not identify the specific endpoint or protocol involved.

Exploitation

The record shows no CISA KEV listing and no exploit references, but EPSS is very high at 0.71227 (99.4th percentile), indicating elevated likelihood of exploitation activity. No ransomware association is documented.

What to do

• Apply the Microsoft security update for CVE-2021-28480 as the first action.
• If patching cannot be immediate, restrict external access to Exchange services and limit exposure of management interfaces.
• Enable and review Exchange and Windows security logging for suspicious server-side activity.
• Verify Exchange build levels against Microsoft guidance and remediate any unsupported or unpatched versions.
• Monitor vendor advisories for updated guidance on this CVE.

Detection

• Hunt for unexpected child processes spawned by Exchange worker processes (w3wp.exe, MSExchange-related binaries).
• Monitor for anomalous outbound connections from Exchange servers to unfamiliar hosts.
• Review IIS and Exchange logs for unusual requests or authentication patterns against Exchange endpoints.
• Alert on new files or web shells written under Exchange and IIS directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.