CVE-2021-33766
Microsoft Exchange Server 2013 … 2019
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-33766 is a high-severity an unspecified weakness vulnerability in Microsoft Exchange Server. Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Microsoft Exchange Server contains an information disclosure vulnerability tracked as CVE-2021-33766. The flaw received a CVSS 3.1 score of 7.3 with a vector indicating network attack vector, low attack complexity, no required privileges or user interaction, and limited impacts to confidentiality, integrity, and availability.
An unauthenticated attacker with network access can exploit the issue to obtain sensitive information from the server and achieve limited additional effects on integrity and availability. The vulnerability was publicly disclosed on 14 July 2021.
Microsoft published remediation guidance in its Security Response Center advisory, and the flaw appears in the CISA Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-20443
Vulnerability Data
Microsoft Exchange Server Information Disclosure Vulnerability
- CWE(s)
- KEV Date Added
- 18 January 2022
Related Threats
Threat-Actor AttributionAI
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.