What is the CVSS score of CVE-2021-34523?

CVE-2021-34523 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 93.9%.

Which versions of Exchange Server are affected by CVE-2021-34523?

CVE-2021-34523 presents critical security risk rated CVSS 9.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2021-34523?

Yes, a public proof-of-concept exploit is available for CVE-2021-34523. Prioritise patching immediately. EPSS: 93.9%.

How to fix or mitigate CVE-2021-34523?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Vendor patch is available.

Exchange Server CVE-2021-34523

CRITICAL

2021-07-14 secure@microsoft.com

Information Disclosure Microsoft Exchange Server

9.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.0 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 11:19 vuln.today

Added to CISA KEV

Oct 30, 2025 - 19:13 cisa

CISA KEV

PoC Detected

Oct 30, 2025 - 19:13 vuln.today

Public exploit code

Patch released

Oct 30, 2025 - 19:13 nvd

Patch available

CVE Published

Jul 14, 2021 - 18:15 nvd

CRITICAL 9.0

DescriptionCVE.org

Microsoft Exchange Server Elevation of Privilege Vulnerability

AnalysisAI

Microsoft Exchange Server contains a privilege escalation vulnerability in the PowerShell backend that allows authenticated Exchange users to escalate to Exchange admin, the second component of the ProxyShell attack chain.

Technical ContextAI

The vulnerability in Exchange's PowerShell Remoting endpoint allows an attacker who has gained access through the SSRF (CVE-2021-34473) to escalate privileges from a standard mailbox user context to Exchange administrator. This enables access to the New-MailboxExportRequest cmdlet for web shell deployment.

RemediationAI

Apply Microsoft security updates. Monitor Exchange PowerShell audit logs for unauthorized cmdlet execution. Restrict Exchange PowerShell access to authorized administrators.

More in Exchange Server

View all

CVE-2021-34473 CRITICAL Act Now POC

9.1 Jul 14

Microsoft Exchange Server contains a pre-authentication SSRF vulnerability known as 'ProxyShell' that allows unauthentic

CVE-2021-26855 CRITICAL Act Now POC

9.1 Mar 03

Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability known as 'ProxyLogon' that allows

CVE-2021-27065 HIGH Act Now POC

7.8 Mar 03

Microsoft Exchange Server allows post-authentication arbitrary file write that enables web shell deployment, the primary

CVE-2021-42321 HIGH Act Now POC

8.8 Nov 10

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is rem

CVE-2021-33766 HIGH Act Now POC

7.3 Jul 14

Microsoft Exchange Server Information Disclosure Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is re

CVE-2022-41080 HIGH Act Now

8.8 Nov 09

Microsoft Exchange Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is re

CVE-2021-26858 HIGH Act Now

7.8 Mar 03

Microsoft Exchange Server allows authenticated attackers to write arbitrary files to the server filesystem, the third co

CVE-2023-21529 HIGH Act Now POC

8.8 Feb 14

Remote code execution in Microsoft Exchange Server 2013, 2016, and 2019 allows authenticated attackers to execute arbitr

CVE-2021-41349 MEDIUM This Month POC

6.5 Nov 10

Microsoft Exchange Server Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely explo

CVE-2021-26857 HIGH Act Now

7.8 Mar 03

Microsoft Exchange Server Unified Messaging service contains a deserialization vulnerability that allows authenticated a

CVE-2021-31196 HIGH Act Now

7.2 Jul 14

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is rem

CVE-2023-21707 HIGH Act Now

8.8 Feb 14

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is rem

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2021-34523 vulnerability details – vuln.today

Back

Exchange Server CVE-2021-34523

Severity by source

CVSS VectorVendor: microsoft

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Exchange Server

Same technique Information Disclosure

Share

External POC / Exploit Code