CVE-2024-21410
Microsoft Exchange Server Privilege Escalation Vulnerability
Description
CVE-2024-21410 is a critical Elevation of Privilege vulnerability in Microsoft Exchange Server, rooted in an improper authentication weakness (CWE-287). The flaw allows an unauthenticated remote attacker to exploit Exchange Server's NTLM relay capabilities to authenticate as the victim user and perform operations on the server on their behalf, effectively gaining elevated privileges without valid credentials. With a CVSS 3.1 score of 9.8 (CRITICAL) and confirmed active exploitation by CISA, CVE-2024-21410 is an urgent remediation target for all organizations running Microsoft Exchange Server. The EPSS score of 3.2% (86.7th percentile) is notable given the critical severity, and the CISA KEV listing confirms this vulnerability has moved beyond theoretical risk into confirmed real-world exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21410(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CWE-287 describes a weakness where software does not correctly implement or enforce authentication mechanisms, allowing an actor to establish a claimed identity without proper verification. In CVE-2024-21410, Microsoft Exchange Server's handling of NTLM authentication allows an attacker to relay credentials captured from a victim to Exchange Server, bypassing the authentication process and gaining elevated access to Exchange functionality as if they were the legitimate user.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2024-21410 carries a CVSS 3.1 score of 9.8 (CRITICAL) and is remotely exploitable without any authentication or user interaction, making it accessible to any attacker with network reach to an Exchange Server. Confidentiality (High): An attacker who relays NTLM credentials can access the victim user's email, calendar, contacts, and other Exchange data without authorization. Integrity (High): The attacker can send emails, modify mailbox rules, or manipulate Exchange configurations on behalf of the compromised user. Availability (High): In elevated scenarios, Exchange service availability can be impacted through unauthorized administrative operations. The scope is unchanged (S:U), meaning the impact is contained to the Exchange environment itself, but given that Exchange frequently holds highly sensitive organizational communications and is integrated with Active Directory, a successful exploit can serve as a powerful pivot point for broader network compromise. CISA's KEV listing confirms active exploitation, and the 86.7th percentile EPSS ranking signals meaningful exploitation activity.
Exploit Maturity
CISA has confirmed that CVE-2024-21410 is actively exploited in the wild, listing it in the Known Exploited Vulnerabilities catalog with a remediation deadline of March 7, 2024. The ransomware association is listed as Unknown for this vulnerability. No exploit URLs tagged as "Exploit" appear in the provided references; the only public reference beyond CISA is the Microsoft patch advisory. The EPSS score of 3.2% (86.7th percentile) indicates that while not in the top tier of exploitation probability scores, this vulnerability is still actively targeted above the majority of all tracked vulnerabilities. Given Exchange Server's role as a high-value target in enterprise environments, organizations should prioritize patching without waiting for further exploit maturity signals.
Remediation
- Apply the Microsoft security update for CVE-2024-21410 immediately via the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410. CISA's required action states: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
- Enable Extended Protection for Authentication (EPA) on Exchange Server, as Microsoft's patch enables this by default — verify it is active on all Exchange servers in your environment after applying the update.
- As an interim mitigation, block NTLM relay attack paths by enabling SMB signing and LDAP signing/channel binding across your Active Directory environment, reducing the attacker's ability to relay captured credentials.
- Monitor Exchange Server authentication logs and network traffic for signs of NTLM relay activity, such as authentication attempts from unexpected source IP addresses or service accounts authenticating in unusual patterns. Alert on unexpected Exchange Web Services (EWS) or Exchange ActiveSync access.
- Audit Exchange Server for unauthorized mailbox access, suspicious inbox rules, or unexpected administrative changes that may indicate prior exploitation. Review Active Directory for signs of privilege escalation or new privileged account creation that could indicate post-exploitation activity.
Technical Details
CVE-2024-21410 is an improper authentication vulnerability (CWE-287) in Microsoft Exchange Server that enables NTLM credential relay attacks. The vulnerability arises because Exchange Server does not enforce Extended Protection for Authentication (EPA) by default on certain endpoints, allowing an attacker to intercept NTLM authentication handshakes — for example by inducing a victim client to authenticate to an attacker-controlled server — and then relay those credentials to an Exchange Server to authenticate as the victim user. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires no authentication and no user interaction, with low attack complexity, making it straightforward for any network-accessible attacker. Microsoft's fix enables EPA on Exchange endpoints by default, breaking the relay chain. Exchange Server's deep integration with Active Directory means a successful relay can expose not just mailbox content but also potentially facilitate further credential attacks against AD-integrated services.
Frequently Asked Questions
Is CVE-2024-21410 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2024-21410 in the wild and has listed it in the Known Exploited Vulnerabilities catalog with a remediation due date of March 7, 2024. The EPSS score of 3.2% (86.7th percentile) indicates above-average exploitation activity relative to all tracked vulnerabilities. Ransomware involvement has not been confirmed for this specific CVE.
What products are affected by CVE-2024-21410?
CVE-2024-21410 affects Microsoft Exchange Server. Microsoft's security advisory specifies which Exchange Server versions and cumulative updates are vulnerable. All on-premises Exchange Server deployments should be evaluated and patched; Microsoft 365 cloud-hosted Exchange is managed by Microsoft and not affected in the same way.
How do I fix CVE-2024-21410?
Apply the Microsoft security update for CVE-2024-21410 available from the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410. After applying the patch, verify that Extended Protection for Authentication (EPA) is enabled on Exchange endpoints. As an interim measure, enable SMB signing and LDAP channel binding across your environment to limit NTLM relay attack opportunities.
How severe is CVE-2024-21410?
CVE-2024-21410 is rated CRITICAL with a CVSS 3.1 score of 9.8, reflecting remotely exploitable, unauthenticated access with full confidentiality, integrity, and availability impact on Exchange Server. The EPSS score of 3.2% (86.7th percentile) combined with confirmed active exploitation by CISA means this vulnerability is actively targeted in real-world attacks. Exchange Server's central role in enterprise communication and AD integration makes successful exploitation particularly damaging.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.