CVE-2021-34523
Microsoft Exchange Server 2013 … 2019
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-34523 is a critical-severity an unspecified weakness vulnerability in Microsoft Exchange Server. Its CVSS base score is 9.0 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2021-34523 is an elevation of privilege vulnerability affecting Microsoft Exchange Server. It carries a CVSS 3.1 base score of 9.0 under the vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N and is listed without an associated CWE.
An attacker with local access and no prior privileges or user interaction can exploit the flaw to obtain high-impact effects on confidentiality and integrity, with the impact extending across a security boundary due to the changed scope.
Public references link the issue to Microsoft Security Response Center guidance and Zero Day Initiative advisory ZDI-21-822, along with proof-of-concept material describing its role in ProxyShell remote code execution chains against Exchange deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-21177
Vulnerability Data
Microsoft Exchange Server Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
Threat-Actor AttributionAI
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.