Junglewise Threat Intelligence

CVE-2021-33766: Microsoft Exchange Server Information Disclosure

CVE-2021-33766 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2022-01-18

Technologies: Microsoft Exchange Server, Microsoft Exchange Server 2019, Microsoft Exchange Server 2016. Vendors: Microsoft.

Executive brief

Microsoft Exchange Server contains an information disclosure vulnerability that allows an unauthenticated attacker to intercept email traffic. The flaw stems from insufficient information handling, potentially leading to the exposure of sensitive communication.

Affected products

  • Microsoft Exchange Server 2013 Cumulative Update 23
  • Microsoft Exchange Server 2016 Cumulative Update 19, Cumulative Update 20
  • Microsoft Exchange Server 2019 Cumulative Update 8, Cumulative Update 9

Timeline

  • 2021-07-14: disclosed: NVD Published Date
  • 2022-01-18: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2022-01-18: exploited: Confirmed exploited in the wild per CISA KEV entry

Related threats