CVE-2021-42321: Microsoft Exchange Server remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityIt is a remotely reachable RCE in Exchange that is in CISA KEV, linked to ransomware use, and has a very high EPSS score, making active exploitation highly likely.

What it is

CVE-2021-42321 is a remote code execution vulnerability in Microsoft Exchange Server. It is remotely reachable over the network with low complexity, though the CVSS vector requires low privileges, meaning an attacker needs some authenticated access. Because it is listed in CISA's Known Exploited Vulnerabilities catalog and has been used in ransomware campaigns, it poses a serious risk to unpatched Exchange deployments.

Impact

A successful attacker can execute arbitrary code on the Exchange server, giving full control over confidentiality, integrity and availability of the host and its data. In practice this can lead to mailbox compromise, lateral movement and ransomware deployment.

Attack surface

The flaw is reached over the network (AV:N) with low attack complexity and no user interaction (UI:N), but the vector indicates low privileges are required (PR:L), so the attacker needs some level of authenticated access to the Exchange environment. No further detail on the exact entry point is provided in the record.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-17 with a due date of 2021-12-01 and flags known ransomware campaign use. EPSS is very high (0.91737, 99.81st percentile) and public exploit references exist, so active exploitation is well established.

What to do

• Apply the Microsoft Exchange Server security updates referenced in the MSRC advisory immediately.
• Prioritize patching internet-facing Exchange servers and any systems still within the CISA KEV remediation window.
• Restrict and monitor privileged Exchange access, and review accounts with elevated roles for signs of compromise.
• Isolate or segment unpatched Exchange servers from untrusted networks until they can be updated.
• Verify backups and ransomware recovery procedures for Exchange and dependent infrastructure.

Detection

• Monitor Exchange server logs and Windows event logs for unexpected process creation or child processes spawned by Exchange services.
• Hunt for known public exploit artifacts and web shell activity on Exchange servers, including unusual files in Exchange virtual directories.
• Alert on anomalous authentication or privilege use against Exchange endpoints consistent with the PR:L vector.
• Correlate network connections to Exchange servers with post-exploitation or ransomware staging behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.