CVE-2021-31196
Published: 14 July 2021
Summary
CVE-2021-31196 is a high-severity an unspecified weakness vulnerability in Microsoft Exchange Server. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 12.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
Microsoft Exchange Server is affected by a remote code execution vulnerability tracked as CVE-2021-31196. The flaw carries a CVSS 3.1 base score of 7.2 with network attack vector, low attack complexity, and high privileges required, resulting in high impact to confidentiality, integrity, and availability.
An authenticated attacker with high privileges can exploit the issue over the network to execute arbitrary code on the Exchange server, achieving full control of the affected system without user interaction.
Microsoft has published remediation guidance in its Security Response Center advisory, and the vulnerability appears in CISA's catalog of known exploited vulnerabilities, indicating confirmed in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-18109
Vulnerability details
Microsoft Exchange Server Remote Code Execution Vulnerability
- CWE(s)
- KEV Date Added
- 21 August 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of vendor patches for the Exchange RCE flaw that Microsoft published and CISA confirmed exploited in the wild.
Limits assignment of the high privileges the authenticated attacker must possess to trigger arbitrary code execution on the Exchange server.
Enforces access-control policy that can block the network-originated code-execution path even for authenticated high-privilege sessions.