Vulnerabilities/Microsoft/CVE-2021-34523

CVE-2021-34523: Microsoft Exchange Server Privilege Escalation Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD9.0Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 3 Nov 2021

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

Recommended action

Apply updates per vendor instructions.

CISA due date 17 Nov 2021 · CWE-287

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
Microsoft Exchange Server 2013 Cumulative Update 2315.00.0 to before 15.00.1497.015Unknown
Microsoft Exchange Server 2016 Cumulative Update 1915.01.0 to before 15.01.2176.012Unknown
Microsoft Exchange Server 2016 Cumulative Update 2015.01.0 to before 15.01.2242.008Unknown
Microsoft Exchange Server 2019 Cumulative Update 815.02.0 to before 15.02.0792.013Unknown
Microsoft Exchange Server 2019 Cumulative Update 915.02.0 to before 15.02.0858.010Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 3 Nov 2021 · Added to CISA KEV
  • 17 Nov 2021 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.