CVE-2021-34523
Microsoft Exchange Server Privilege Escalation Vulnerability
Published Jul 14, 2021 · updated Aug 10, 2026 · microsoft exchange server
Microsoft Exchange Server Elevation of Privilege Vulnerability
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jul 14, 2021 · Catalog
Detected
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 10, 2026 · Catalog
Updated
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
Required action
Apply updates per vendor instructions.
CISA due date Nov 17, 2021
Affected
- cpe microsoft/exchange server2013
- cpe microsoft/exchange server2016
- cpe microsoft/exchange server2019
- vendor Microsoft Exchange Serverversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2021-34523
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
cisa.gov - CVE.orgVulnerability recordCVE-2021-34523
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-34523
30-day exploitation probability 100.0%
first.org - Metasploit ModulesPublic exploit moduleexploit_windows/http/exchange_proxyshell_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2021-34523
Microsoft Exchange Server Elevation of Privilege Vulnerability
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com