CVE-2021-28482: Microsoft Exchange Server remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and very high EPSS (0.832) indicate a serious, likely-exploited flaw, though the record lacks root-cause and exploit details.

What it is

CVE-2021-28482 is a remote code execution vulnerability in Microsoft Exchange Server. It carries a CVSS 3.1 base score of 8.8 (HIGH) with a network vector, low attack complexity, and low privileges required, meaning an authenticated attacker can potentially execute code on the server. The record provides only a generic description and no root-cause detail, so the exact vulnerable component is not specified.

Impact

A successful attacker gains code execution in the context of the Exchange server process, which can lead to full compromise of the mail server and its data. With high confidentiality, integrity, and availability impact ratings, the consequences extend to mailbox data, server integrity, and service availability.

Attack surface

The vulnerability is reachable over the network (AV:N) with low attack complexity and no user interaction (UI:N), but it requires low privileges (PR:L), so the attacker needs some authenticated access before exploitation. No specific protocol or endpoint is identified in the record.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use, but EPSS is very high at 0.832 (99.7th percentile), indicating a strong likelihood of exploitation activity. The only references are Microsoft patch advisories, with no public exploit or PoC tags provided.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for CVE-2021-28482 as soon as possible.
• Restrict and monitor authenticated access to Exchange services, limiting accounts that can reach the server.
• Enable and review Exchange server logging and audit trails for anomalous process or command execution.
• Segment Exchange servers from untrusted networks and enforce least privilege on service accounts.
• Track Microsoft Exchange cumulative updates and security guidance for related fixes.

Detection

• Monitor Exchange server logs for unexpected child processes spawned by Exchange worker processes (for example w3wp.exe or MSExchange-related binaries).
• Alert on suspicious command-line execution or file writes in Exchange server directories and web root paths.
• Review authentication logs for unusual or low-privileged accounts accessing Exchange services around the time of suspected activity.
• Correlate network connections to Exchange servers with known exploitation indicators and unexpected outbound traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.