CVE-2021-28480
Microsoft Exchange Server 2013 … 2019
High EPSS
CVSS Score v3.1
9.8
Click a component to see what it means
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.71
99.4th percentile
Summary
CVE-2021-28480 is a critical-severity an unspecified weakness vulnerability in Microsoft Exchange Server. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-15158
Vulnerability Data
Microsoft Exchange Server Remote Code Execution Vulnerability
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Remote code execution vulnerability in a public-facing Exchange Server directly enables exploitation of the server application.
T1059 Command and Scripting Interpreter Executionconfidence: MEDIUM
Successful RCE on Exchange can be used to execute arbitrary commands or scripts on the compromised server.
inferred from description · MITRE ATT&CK Enterprise v19.0
CVEs Like This One
CVE-2023-36778Same product: Microsoft Exchange Server
CVE-2021-31196Same product: Microsoft Exchange Server
CVE-2023-36745Same product: Microsoft Exchange Server
CVE-2020-17143Same product: Microsoft Exchange Server
CVE-2023-36777Same product: Microsoft Exchange Server
CVE-2023-21764Same product: Microsoft Exchange Server
CVE-2023-21710Same product: Microsoft Exchange Server
CVE-2023-38181Same product: Microsoft Exchange Server
CVE-2023-21761Same product: Microsoft Exchange Server
CVE-2021-26855Same product: Microsoft Exchange Server
Affected Assets
microsoft
exchange server
2013, 2016, 2019
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.