CVE-2021-27065HIGH
Microsoft Exchange Server Remote Code Execution Vulnerability
AV AC PR UI S C I A CVSS EPSS %ile KEV L L N R U H H H 7.8 .9995 100.0 YES
AFFECTED Product Versions Fixed Microsoft Exchange Server 2013 Cumulative Update 21 15.00.0 – — Microsoft Exchange Server 2013 Cumulative Update 22 15.00.0 – — Microsoft Exchange Server 2013 Cumulative Update 23 15.00.0 – — Microsoft Exchange Server 2013 Service Pack 1 15.00.0 – — Microsoft Exchange Server 2016 Cumulative Update 10 15.01.0 – — Microsoft Exchange Server 2016 Cumulative Update 11 15.01.0 – — Microsoft Exchange Server 2016 Cumulative Update 12 15.01.0 – — Microsoft Exchange Server 2016 Cumulative Update 13 15.01.0 – — Microsoft Exchange Server 2016 Cumulative Update 14 15.01.0 – — Microsoft Exchange Server 2016 Cumulative Update 15 15.01.0 – — + 15 more
TIMELINE Feb 10 Reserved by microsoft Nov 3 Added to CISA KEV, remediation due 2022-05-03 Nov 3 Published (CNA: microsoft) Aug 12 EXPLOIT PUBLISHED — CVE-2021-27065 (Microsoft Exchange Server 2019). Public exploit reference added.
CWE-22 · CNA: microsoft · CVSS v3.1 · 5 references · NVD status: Analyzed · KEV due May 3, 2022