CVE-2021-27065 is a critical Remote Code Execution (RCE) vulnerability affecting Microsoft Exchange Server, enabling attackers to execute arbitrary code on vulnerable systems. With a CVSS score of 7.8 (HIGH), it presents a significant risk due to its low attack complexity and potential for complete compromise of confidentiality, integrity, and availability. This vulnerability is actively exploited in the wild, notably by ransomware campaigns, and has readily available exploit modules in tools like Metasploit. Its high EPSS score, FAUCET Risk Score of 100/100, and extensive community discussion and media coverage underscore its widespread impact and urgent need for remediation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:* | ||
2013CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:* | ||
2016CPE matchmatch criteria | cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.