Three vulnerabilities from DEVCORE researcher Orange Tsai could be chained to achieve unauthenticated remote code execution. Attackers are searching for vulnerable instances to exploit. Update August 23: The Analysis section has been updated with information about exploitation of this vulnerability chain. Organizations should update immediately.

ProxyShell: Attackers Actively Scanning for Vulnerable Microsoft Exchange Servers (CVE-2021-34473)

Microsoft Exchange Server Remote Code Execution Vulnerability

The Microsoft Exchange running on the remote host is affected by a remote code execution vulnerability. An unauthenticated remote attacker can exploit this to execute arbitrary code.

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker could exploit this to     execute unauthorized arbitrary code. (CVE-2021-28483, CVE-2021-28482,     CVE-2021-28481, CVE-2021-28480, CVE-2021-34473)

  - An elevation of privilege vulnerability. An attacker can exploit this to   gain elevated privileges. (CVE-2021-34523)

  - An information disclosure vulnerability. An attacker can exploit this to   disclose potentially sensitive information. (CVE-2021-33766)

ID	Name	Product	Family	Severity
152458	Microsoft Exchange Server RCE (ProxyShell)	Nessus	Windows	critical
148476	Security Updates for Microsoft Exchange Server (April 2021)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2021-34473

critical

Tenable Plugins

critical

critical