Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Microsoft Exchange Server Remote Code Execution Vulnerability
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L H N U H H H 7.2 .5406 98.9 YES
AFFECTED
Product Versions Fixed
Microsoft Exchange Server 2013 Cumulative Update 23 15.00.0 – —
Microsoft Exchange Server 2016 Cumulative Update 20 15.01.0 – —
Microsoft Exchange Server 2016 Cumulative Update 21 15.01.0 – —
Microsoft Exchange Server 2019 Cumulative Update 10 15.02.0 – —
Microsoft Exchange Server 2019 Cumulative Update 9 15.02.0 – —
TIMELINE
Apr 14 Reserved by microsoft
Aug 21 Added to CISA KEV, remediation due 2024-09-11
Aug 21 Published (CNA: microsoft)
Description
Microsoft Exchange Server Remote Code Execution Vulnerability
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| April 14, 2021 | Reserved | Reserved by microsoft |
| August 21, 2024 | KEV ADDED | Added to CISA KEV, remediation due 2024-09-11 |
| August 21, 2024 | Published | Published (CNA: microsoft) |
Affected
Affected products and packages — 5 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Microsoft | Microsoft Exchange Server 2013 Cumulative Update 23 | — | 15.00.0 | — |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 20 | — | 15.01.0 | — |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 21 | — | 15.01.0 | — |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 10 | — | 15.02.0 | — |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 9 | — | 15.02.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-31196 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.