Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Microsoft Exchange Server Remote Code Execution Vulnerability
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2021-11-17. Apply updates per vendor instructions.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
3 versions affected across 1 product
1/ ProxyShell comprises CVE-2021-34473, CVE-2021-34523 & CVE-2021-31207. Despite patches, unpatched systems are exploited for initial access. #Microsoft #Exchange
Post summary
ProxyShell, comprising CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, continues to be actively exploited for initial access on unpatched Microsoft Exchange systems despite the availability of patches.
5/ BlackCat's attack on the logistics firm Expeditors in 2022 showcased their ability to disrupt supply chains. They often exploit CVE-2021-34473 #ThreatIntel #InfoSec
Post summary
BlackCat reportedly exploits CVE-2021-34473 in attacks against Expeditors, showing active use of this vulnerability in the wild.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | microsoft | exchange_server | 2013 | - | - |
| App | microsoft | exchange_server | 2016 | - | - |
| App | microsoft | exchange_server | 2016 | - | - |
| App | microsoft | exchange_server | 2019 | - | - |
| App | microsoft | exchange_server | 2019 | - | - |