CVE-2021-34473

Confirmed PUBLISHED

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 9, Microsoft Exchange Server 2016 Cumulative Update 20, Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Exchange Server 2019 Cumulative Update 8

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.1 Critical EPSS 100.0%

At a Glance

Microsoft Exchange Server Remote Code Execution Vulnerability

malware cisa ransomware metasploit nuclei_scanner microsoft

CVE Published: Jul 14, 2021
Exploitation Reported: Nov 03, 2021
CVSS: 9.1 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 23	15.00.0 to < 15.00.1497.015	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 9	15.02.0 to < 15.02.0858.010	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 20	15.01.0 to < 15.01.2242.008	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 19	15.01.0 to < 15.01.2176.012	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 8	15.02.0 to < 15.02.0792.013	Affected

CVE References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34473 portal.msrc.microsoft.com · CVE Record https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CV...
zerodayinitiative.com/advisories/ZDI-21-821 zerodayinitiative.com · CVE Record https://www.zerodayinitiative.com/advisories/ZDI-21-821/
packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-R... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyS...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
The Shadowserver	2026-06-01 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34473.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.1 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Used in malware

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-08-11 12:20:07 UTC · GitHub

Weaknesses (CWE)

CWE-918

Server-Side Request Forgery (SSRF)

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34473.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

ipsBruno/CVE-2021-34473-NMAP-SCANNER

github · Created 2022-11-16 08:22:29 UTC · 2 stars

A massive scanner for CVE-2021-34473 Microsoft Exchange Windows Vulnerability

je6k/CVE-2021-34473-Exchange-ProxyShell

github · Created 2021-11-22 07:47:09 UTC · 17 stars

对Exchange Proxyshell 做了二次修改，精确的拆分、实现辅助性安全测试。

p2-98/CVE-2021-34473

github · Created 2021-08-16 11:27:13 UTC · 30 stars

CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability

RaouzRouik/CVE-2021-34473-scanner

github · Created 2021-08-11 12:20:07 UTC · 6 stars

Scanner for CVE-2021-34473, ProxyShell, A Microsoft Exchange On-premise Vulnerability

Exchange Server - Remote Code Execution

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

First public exploitation report

Exploit observed in malware
11 Aug 2021 12:20 UTC almost 5 years ago

11 Aug 2021 12:20 UTC · almost 5 years ago

Public PoC available

Public proof-of-concept code published
14 Jul 2021 17:54 UTC about 5 years ago

14 Jul 2021 17:54 UTC · about 5 years ago

CVE published

Vulnerability disclosed publicly
9 Jun 2021 00:00 UTC about 5 years ago

9 Jun 2021 00:00 UTC · about 5 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-34473

{
  "cve_id": "CVE-2021-34473",
  "title": "Microsoft Exchange Server Remote Code Execution Vulnerability",
  "affected_vendor": "Microsoft",
  "affected_product": "Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 9, Microsoft Exchange Server 2016 Cumulative Update 20, Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Exchange Server 2019 Cumulative Update 8",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.1,
  "epss_score": 0.99999,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-34473

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API