https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31206

https://www.zerodayinitiative.com/advisories/ZDI-21-826/

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

- A remote code execution vulnerability. An attacker can exploit this to bypass   authentication and execute unauthorized arbitrary commands.  (CVE-2021-31196,   CVE-2021-31206)

- An elevation of privilege vulnerability. An attacker can exploit this to gain   elevated privileges. (CVE-2021-33768, CVE-2021-34470)

Note: Nessus is unable to determine if the latest Active Directory schema has been applied.

CVE-2021-31206

high

Tenable Plugins

high