CVE-2021-31207: Microsoft Exchange Server security feature bypass via unrestricted file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has near-certain EPSS probability, and public exploit code exists for the ProxyShell chain.

What it is

CVE-2021-31207 is a security feature bypass in Microsoft Exchange Server caused by unrestricted file upload (CWE-434). It is one of the three flaws chained in the ProxyShell exploit chain, where it is used after authentication to write a web shell and achieve remote code execution. It matters because the chain is actively exploited and has been used in ransomware campaigns.

Impact

An authenticated attacker can bypass Exchange security features to upload arbitrary files, typically a web shell, leading to remote code execution on the mail server. This gives full control of the Exchange host and access to mail data and the underlying Windows system.

Attack surface

Reachable over the network against Exchange Server web endpoints (CVSS AV:N). The vector requires high privileges (PR:H) and no user interaction (UI:N), so the attacker needs valid credentials or must first chain another flaw to obtain them.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is 0.99782 (99.956th percentile). Public exploit code is referenced (Packet Storm ProxyShell RCE), confirming active exploitation.

What to do

• Apply the Microsoft Exchange security updates referenced in the vendor advisory immediately.
• Verify Exchange servers are patched against the full ProxyShell chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
• Restrict external access to Exchange OWA/ECP endpoints and enforce MFA to reduce credential-based reach.
• Audit and remove unauthorized web shells and unexpected files under Exchange web directories.
• Monitor for and block known ProxyShell exploitation patterns at the perimeter.

Detection

• Hunt for newly created .aspx or other executable files in Exchange OWA/ECP directories.
• Monitor IIS and Exchange logs for unusual POST requests to autodiscover or ECP paths consistent with ProxyShell.
• Alert on web server processes spawning cmd.exe, powershell.exe or other unexpected child processes.
• Review authentication logs for anomalous or compromised accounts accessing Exchange web endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.