CVE-2021-28480

What it actually does

CVE-2021-28480 is a pre-authentication remote code execution vulnerability in Microsoft Exchange Server. Because the flaw is network-exploitable with low attack complexity and requires no credentials or user interaction, an attacker who can reach the vulnerable Exchange service can potentially execute arbitrary code in the context of the Exchange server process. Successful exploitation can lead to full compromise of mail data, server integrity, and service availability, and may provide a foothold for broader domain or network intrusion depending on the server’s privileges and connectivity.

Why it matters to the business

A vulnerable internet-facing Exchange server can allow an unauthenticated attacker to take control of a core email system, exposing sensitive mailboxes, enabling email impersonation, interrupting business communications, and creating a launch point for wider compromise. The high CVSS score, weaponized exploit maturity, and high EPSS probability indicate meaningful exploitation risk even though this vulnerability is not currently listed in CISA KEV. Exchange servers are commonly high-value targets because they contain sensitive communications and often have privileged integrations with identity and internal services.

How an attack unfolds

An attacker first identifies exposed Microsoft Exchange Server endpoints and fingerprints versions likely missing the April 2021 security updates or later cumulative updates. They then send a specially crafted unauthenticated network request to the vulnerable Exchange service that triggers the remote code execution condition. If exploitation succeeds, code runs on the Exchange server, allowing the attacker to execute commands, deploy web shells or other persistence mechanisms, access mailbox data, create or abuse accounts, move laterally, and stage additional tooling. Post-exploitation often focuses on persistence, credential theft, mailbox exfiltration, and using the trusted Exchange server position to reach internal systems.

How to fix it

Apply the relevant Microsoft Exchange Server security updates from April 2021 or a later supported cumulative update and security update for the installed Exchange version. Because no fixed versions were provided in the input, administrators should verify the exact installed Exchange major version and cumulative update level against Microsoft’s official Exchange Server security update guidance and install the latest supported update chain. Restrict direct internet exposure to Exchange administrative and service endpoints wherever possible, enforce network-layer access controls, and place Exchange behind supported protective controls. If compromise is suspected, patching alone is insufficient: perform incident response, remove persistence such as web shells, rotate credentials, review mailbox access, and rebuild severely compromised servers from trusted media if integrity cannot be assured.

How to confirm the fix worked

Confirm that each Exchange server is running a supported cumulative update plus the applicable security update released in April 2021 or later. Use Microsoft Exchange Health Checker and Microsoft-provided security update verification guidance to validate build numbers and patch status. Externally verify that only required Exchange services are reachable and that administrative endpoints are not broadly exposed. Review vulnerability scanner results and authenticated patch inventory to ensure CVE-2021-28480 is no longer reported. After remediation, restart required Exchange services and validate mail flow, Outlook Web App, Exchange Control Panel, ActiveSync, and other business-critical Exchange functions.

Typical attack path

1. Scan the internet or target network for exposed Microsoft Exchange Server services.
2. Fingerprint Exchange build information, response behavior, or patch level to identify potentially vulnerable systems.
3. Send a crafted unauthenticated request to trigger remote code execution.
4. Execute commands or upload a web shell or similar remote access mechanism.
5. Enumerate mailboxes, configuration, credentials, and connected directory services.
6. Establish persistence and attempt privilege escalation or lateral movement.
7. Exfiltrate email data, deploy additional malware, or disrupt Exchange availability.

How to detect it

To determine whether exploitation already occurred, collect and review IIS logs for Exchange virtual directories, Windows Event Logs, Exchange Management logs, PowerShell logs, EDR telemetry, antivirus detections, and file system artifacts in Exchange web directories. Look for abnormal unauthenticated requests followed by server-side errors, unexpected ASPX files, command execution, PowerShell launched by Exchange or IIS worker processes, suspicious mailbox export activity, new or modified accounts, and outbound connections from the Exchange server to unfamiliar hosts. Pay particular attention to activity around and after April 2021, but continue hunting later because public exploit tooling remains weaponized. Useful log sources include IIS W3C logs under Exchange/IIS log paths, Windows Security logs, PowerShell Operational logs, Sysmon if deployed, Exchange Admin Audit logs, Exchange HttpProxy logs, ECP/OWA logs, and EDR process/network/file telemetry. Investigate any evidence that w3wp.exe, UMWorkerProcess.exe, or other Exchange-related processes spawned cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, rundll32.exe, regsvr32.exe, or scripting interpreters. Also search for web shells or recently modified files in Exchange Client Access web paths, especially files with ASPX extensions that do not match a known-good baseline.

• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• UMWorkerProcess.exe -> cmd.exe
• UMWorkerProcess.exe -> powershell.exe
• C:\inetpub\wwwroot\aspnet_client\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\auth\*.aspx
• MSExchange Management
• New-MailboxExportRequest
• Set-OabVirtualDirectory
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• certutil.exe -urlcache
• bitsadmin /transfer
• /ecp/
• /owa/auth/
• /aspnet_client/
• X-BEResource
• X-AnonResource-Backend
• X-CalculatedBETarget

What your security team should do

• Prioritize immediate patch verification for all Microsoft Exchange servers, especially internet-facing systems, because exploitation is weaponized and EPSS is high.
• Run Microsoft Exchange Health Checker or equivalent authenticated inventory to identify unsupported or unpatched Exchange builds.
• Review historical logs and file systems for evidence of exploitation before assuming patching fully resolves risk.
• Hunt for web shells, suspicious ASPX files, unusual PowerShell activity, unexpected child processes spawned by Exchange/IIS worker processes, and anomalous mailbox export or access patterns.
• Restrict external access to Exchange endpoints to only what is operationally required and place administrative access behind VPN, conditional access, or equivalent controls.
• Rotate credentials and review privileged group membership if exploitation is suspected or if suspicious Exchange process activity is found.
• Ensure Exchange servers are covered by EDR, centralized Windows Event Log collection, IIS log retention, and file integrity monitoring for web directories.