Is CVE-2021-42321 exploited in the wild?

Yes. CVE-2021-42321 is known to be exploited in the wild, first recorded on 17 November 2021. Treat it as urgent.

How severe is CVE-2021-42321?

Critical severity, with a CVSS score of 8.8, published 17 November 2021.

Which products and versions are affected?

Microsoft Exchange Server 2016 Cumulative Update 21, Cumulative Update 22; Microsoft Exchange Server 2019 Cumulative Update 10, Cumulative Update 11.

Is there a fix for CVE-2021-42321?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-42321 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2021-42321?

Check whether you run Microsoft Exchange. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-42321: Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-42321 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2021-11-17

An authenticated remote code execution vulnerability exists in Microsoft Exchange Server due to improper validation of cmdlet arguments. An attacker with low privileges can exploit this flaw to execute arbitrary code on the server.

Vendors: Microsoft.

Quick answers

Is CVE-2021-42321 exploited in the wild?: Yes. CVE-2021-42321 is known to be exploited in the wild, first recorded on 17 November 2021. Treat it as urgent.
How severe is CVE-2021-42321?: Critical severity, with a CVSS score of 8.8, published 17 November 2021.
Which products and versions are affected?: Microsoft Exchange Server 2016 Cumulative Update 21, Cumulative Update 22; Microsoft Exchange Server 2019 Cumulative Update 10, Cumulative Update 11.
Is there a fix for CVE-2021-42321?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-42321 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2021-42321?: Check whether you run Microsoft Exchange. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

Microsoft Exchange Server 2016 Cumulative Update 21, Cumulative Update 22
Microsoft Exchange Server 2019 Cumulative Update 10, Cumulative Update 11

Timeline

2021-11-09: disclosed: NVD Published Date
2021-11-17: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2021-11-17: advisory: MSRC advisory published/updated
2021-11-17: exploited: Reported as exploited in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.