CVE-2021-42321

This vulnerability is like a hidden “back door” in your email server software: a remote attacker can potentially run their own code on the machine that runs Microsoft Exchange Server. If that happens, they may be able to take over the server, steal email/data, or knock the system offline. Because it has been used in ransomware attacks, it’s the kind of issue that small businesses should treat as urgent.

This matters if you run Microsoft Exchange Server (including Microsoft Exchange Server 2016 cumulative updates and Microsoft Exchange Server 2019 cumulative updates listed here). It’s a remote code execution flaw that attackers can trigger over the network with low required authentication, and it does not require you to click anything. If you can reach your Exchange Server from the internet (or otherwise allow network access that could reach the vulnerable component), you should assume this is reachable—especially given that it has been exploited in ransomware campaigns.

This is RED because this vulnerability has been confirmed as exploited in real-world ransomware campaigns (CISA KEV) and public exploits exist. Attackers actively use this kind of flaw to seize servers and then spread ransomware or steal data. You should prioritize patching Exchange Server immediately.

1. Confirm exposure (what version you’re on)

• Identify the installed Microsoft Exchange Server edition and cumulative update (CU) level.
• Determine whether you are on one of the impacted CU baselines referenced by the fixed-version mapping (2016 CU21, 2016 CU22, 2019 CU10, 2019 CU11).

2. Validate against the fixed versions (use Microsoft’s guidance)

• 2016 CU21: update until you reach 15.01.2308.020.
• 2016 CU22: update until you reach 15.01.2375.017.
• 2019 CU10: update until you reach 15.02.0792.019.
• 2019 CU11: update until you reach 15.02.0986.014.
• Follow Microsoft vendor instructions for how to apply Exchange Server updates safely.

3. Upgrade / patch

• Apply the corresponding Exchange Server update so your build number matches (or supersedes) the fixed version for your CU level.
• Plan for the expected maintenance window for Exchange patching (service restarts and post-update verification are common).

4. Post-patch verification

• Confirm Exchange services start normally and mail flow works.
• Check server and Exchange logs for suspicious remote activity around the time period when your server was unpatched.

5. If patching must be delayed

• Reduce exposure immediately by restricting network access to Exchange Server to only what is required (for example, limit inbound access to approved sources and remove unnecessary public exposure).
• Treat this as temporary mitigation only; you still need to patch to the fixed build as above.

Severity is high (remote code execution; network attack vector). Findings indicate remote execution of arbitrary code on Microsoft Exchange Server, with low required authentication and no user interaction. The vulnerability is listed in the CISA KEV program and was added in 2021-11-17; CISA remediation due date was 2021-12-01, with required action to apply vendor updates. Real-world exploitation is confirmed by KEV (used in ransomware campaigns). Public exploits are available (2 known), increasing the practical likelihood of compromise. Fixes are available as Exchange cumulative updates with the specific fixed build numbers listed in the PATCH finding. “KEV” means CISA has identified this vulnerability as actively exploited in the wild, which is why urgency is maximal despite any predictive scoring.