CVE-2021-42321
Microsoft Exchange Server Remote Code Execution Vulnerability
Description
CVE-2021-42321 is a high-severity remote code execution vulnerability in Microsoft Exchange Server 2016 and 2019. The flaw stems from improper validation of cmdlet arguments, which allows an authenticated attacker to execute arbitrary code on the target server. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and it has been linked to ransomware campaigns. With an EPSS score of 93.4% (99.8th percentile), this Microsoft Exchange vulnerability presents a near-certain probability of exploitation and demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321
- http://packetstormsecurity.com/files/166153/Microsoft-Exchange-Server-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/168131/Microsoft-Exchange-Server-ChainedSerializationBinder-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42321(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42321(US Government Resource)
Weakness Type
Deserialization / Improper Input Validation
CVE-2021-42321 arises from improper validation of cmdlet arguments in Microsoft Exchange Server, which can be leveraged to achieve remote code execution. The vulnerability is rooted in insecure deserialization of user-controlled data within the Exchange PowerShell backend, allowing authenticated users to inject malicious objects that are executed on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2021-42321 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting its significant threat to enterprise environments. The vulnerability is remotely exploitable over the network with low attack complexity, requiring only low-level authentication but no user interaction. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the Exchange server, enabling attackers to read emails, modify mailbox data, deploy backdoors, and disrupt mail services. The EPSS score of 93.4% indicates near-certain exploitation activity, and CISA has confirmed its use in ransomware operations, making this a top-priority threat for any organization running on-premises Microsoft Exchange Server.
Exploit Maturity
CVE-2021-42321 has a well-established exploit landscape. Public exploit code is available via Packet Storm Security and an additional ChainedSerializationBinder exploit, significantly lowering the barrier for attackers. CISA has confirmed active exploitation in the wild and has flagged this vulnerability as used in ransomware campaigns. The EPSS score of 93.4% (99.8th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted Exchange vulnerabilities. Federal agencies were required to remediate by 2021-12-01 under CISA's binding operational directive.
Remediation
- Apply Microsoft security updates immediately as required by CISA KEV. Install the November 2021 cumulative updates for Exchange Server 2016 and Exchange Server 2019 from the Microsoft Security Response Center advisory.
- Verify that all Exchange Server instances are running patched versions. Affected versions include Exchange Server 2016 and Exchange Server 2019 — confirm patching status using the Exchange Server Health Checker script.
- Restrict access to Exchange administrative interfaces by implementing network segmentation and limiting PowerShell remoting access to authorized administrators only. Consider placing Exchange servers behind a reverse proxy with WAF capabilities to filter malicious requests.
- Review Exchange server logs for indicators of compromise, including suspicious PowerShell activity, unusual cmdlet execution patterns, and unauthorized mailbox access. Check for webshells that may have been deployed prior to patching.
- Implement application-level allowlisting and enable Advanced Audit Policy logging on Exchange servers to detect future deserialization-based attacks against cmdlet endpoints.
Technical Details
CVE-2021-42321 exploits improper validation of cmdlet arguments within the Microsoft Exchange Server PowerShell backend. Specifically, the vulnerability targets the deserialization process in the ChainedSerializationBinder, where an authenticated attacker can supply specially crafted serialized objects that bypass type validation checks. When these malicious objects are deserialized by the Exchange server, they trigger arbitrary code execution in the context of the SYSTEM account. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires network access and low-privilege authentication but involves no complexity barriers or user interaction, making it straightforward for any authenticated user to exploit.
Frequently Asked Questions
Is CVE-2021-42321 being actively exploited?
Yes. CVE-2021-42321 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. CISA has also flagged this vulnerability as used in ransomware campaigns. The EPSS score of 93.4% (99.8th percentile) indicates near-certain exploitation probability.
What products are affected by CVE-2021-42321?
CVE-2021-42321 affects Microsoft Exchange Server 2016 and Microsoft Exchange Server 2019. Organizations running on-premises Exchange deployments should verify their patching status immediately.
How do I fix CVE-2021-42321?
Apply the November 2021 cumulative updates for Microsoft Exchange Server from the Microsoft Security Response Center. Restrict access to Exchange administrative interfaces and review server logs for indicators of compromise, including webshells and suspicious PowerShell activity.
How severe is CVE-2021-42321?
CVE-2021-42321 has a CVSS 3.1 score of 8.8 (HIGH) and an EPSS score in the 99.8th percentile. Its confirmed use in ransomware campaigns and the availability of public exploit code make it one of the most critical Exchange vulnerabilities requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.