Vulnerability Intelligence

🛡 CVE-2021-34523

Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft Exchange Server CWE-287

Ransomware use

KNOWN
CISA KEV

EPSS

100.0%
Likely exploited · 100th pct

Added to KEV

2021-11-03
CISA

Remediate by

2021-11-17
⚠ OVERDUE

CWE

CWE-287
weakness

📈 EPSS exploit probability

100.0%
FIRST EPSS — 30-day probability of exploitation in the wild · band Likely exploited · higher than 100% of all scored CVEs

⚠ KEV remediation overdue

CISA required federal remediation by 2021-11-17. This exploited vulnerability is past its Binding Operational Directive 22-01 due date — prioritize patch/mitigation and hunt for exploitation.

📄 Description

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

🏹 Attributed exploitation

Malware / ransomware (KEV): Conti, LockFile, BlackByte (ProxyShell)

Threat actors (KEV): multiple ransomware

Actor pivots: 🏹 multiple ransomware
Malware pivots: 🦠 Conti 🦠 LockFile 🦠 BlackByte 🦠 BlackByte (ProxyShell)
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

🔍 Lookup & Enrich

💡 Recommendations

⚙ Automation

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php