CVE-2021-28482

What it actually does

CVE-2021-28482 is a remote code execution vulnerability in Microsoft Exchange Server. The CVSS vector indicates network reachability, low attack complexity, no user interaction, and required low privileges, meaning an attacker who can authenticate with a low-privileged account can trigger the flaw remotely and execute code in the context of the vulnerable Exchange service. Successful exploitation can compromise confidentiality, integrity, and availability of the mail server, potentially allowing mailbox access, server-side code execution, service disruption, and further movement within the Windows domain environment where Exchange is highly privileged.

Why it matters to the business

A compromised Exchange server can expose sensitive email, credentials, attachments, address books, and internal communications, while also giving an attacker a foothold in a high-value infrastructure component. Operationally, this can lead to mail outages, unauthorized email access or tampering, credential theft, regulatory exposure, incident response costs, and possible lateral movement into broader business systems. Although this vulnerability is not listed in CISA KEV and no exploit maturity is provided, the EPSS score is high, indicating meaningful likelihood of exploitation activity and warranting prioritized remediation for any exposed or internally reachable Exchange deployment.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable Microsoft Exchange Server and obtains or uses existing low-privileged credentials, such as a compromised mailbox account. Because the vulnerability requires authentication but no user interaction, the attacker can send a crafted request to the vulnerable Exchange service over the network. If the server is unpatched and the vulnerable code path is reached, Exchange processes attacker-controlled data in a way that enables code execution on the server. From there, the attacker may run commands, deploy web shells or tooling, access mailbox data, dump credentials from memory or disk, modify mail flow rules, and pivot into Active Directory or other internal systems depending on privileges available on the Exchange host.

How to fix it

Apply the Microsoft security updates released for Exchange Server addressing CVE-2021-28482 and ensure Exchange is updated to a supported cumulative update plus the latest applicable security update. Because no fixed version list was provided, administrators should consult the Microsoft Security Update Guide for the exact update matching their Exchange Server version and cumulative update level. Prioritize patching externally accessible Exchange servers first, followed by internal Exchange servers. If immediate patching is not possible, reduce exposure by restricting Exchange administrative and service endpoints to trusted networks, enforcing MFA for remote access where applicable, disabling or blocking unnecessary external access, monitoring for suspicious authenticated activity, and ensuring endpoint protection is active on Exchange hosts. Mitigations should be treated as temporary; patching is the durable fix.

How to confirm the fix worked

Confirm remediation by verifying the installed Exchange Server build number and installed security update level against Microsoft’s published fixed builds for the relevant Exchange version. Use the Exchange Management Shell and Windows update inventory to confirm the latest supported cumulative update and security update are present. Run authenticated vulnerability scanning against Exchange endpoints to validate that CVE-2021-28482 is no longer reported. Review exposure by confirming only required Exchange services are reachable from untrusted networks. After patching, restart required Exchange services or the host if directed by Microsoft update guidance, then verify mail flow, Outlook on the web, ECP, ActiveSync, and other required Exchange functions continue to operate normally.

Typical attack path

1. Reconnaissance to identify Microsoft Exchange Server instances and exposed Exchange endpoints.
2. Acquire valid low-privileged Exchange or domain credentials through phishing, password reuse, credential stuffing, or prior compromise.
3. Authenticate to the Exchange service using the obtained account.
4. Send a crafted network request that triggers the vulnerable Exchange code path.
5. Execute attacker-controlled code on the Exchange server in the service context.
6. Establish persistence, commonly through web shells, scheduled tasks, new services, or modified Exchange configuration.
7. Access or export mailbox data, collect credentials, and enumerate the Windows domain.
8. Move laterally to additional systems or disrupt mail services if aligned with attacker objectives.

How to detect it

To determine whether exploitation already occurred, examine IIS logs, Exchange logs, Windows Security logs, PowerShell logs, EDR telemetry, and file system artifacts on Exchange servers. Focus on the period before patching and any time the server was exposed to untrusted networks. Look for authenticated requests to Exchange endpoints followed by unusual server-side process execution, especially IIS worker processes or Exchange services spawning command shells, PowerShell, scripting engines, archive utilities, or network tools. Review IIS logs under Exchange web paths for suspicious POST activity, abnormal user agents, requests from unusual IP addresses, and access patterns tied to low-privileged accounts that subsequently correlate with administrative changes or process execution. Inspect web directories for newly created ASPX files or other unexpected executable content. Review PowerShell Operational logs and Exchange Management logs for mailbox exports, role changes, transport rule creation, mailbox forwarding changes, and suspicious remote PowerShell sessions. Check Windows Security logs for unusual logons, privilege use, service creation, scheduled task creation, and new local or domain accounts. Because no public exploit indicators are provided in the input, detection should emphasize behavioral correlations: authenticated Exchange access followed by web shell creation, suspicious child processes, credential access, mailbox export, or lateral movement.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning regsvr32.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning mshta.exe
• MSExchangeServiceHost.exe spawning cmd.exe
• MSExchangeServiceHost.exe spawning powershell.exe
• C:\inetpub\wwwroot\aspnet_client\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\auth\*.aspx
• New-ManagementRoleAssignment
• New-MailboxExportRequest
• Set-Mailbox -ForwardingSmtpAddress
• Set-InboxRule
• New-TransportRule
• Event ID 4688
• Event ID 4698
• Event ID 7045
• Event ID 4624 LogonType=3

What your security team should do

• Inventory all Microsoft Exchange Server instances, including internet-facing, internal, hybrid, and legacy systems.
• Prioritize patching of Exchange servers exposed to the internet or reachable from less-trusted network segments.
• Verify that each Exchange server is on a supported cumulative update and has the Microsoft security update that addresses this vulnerability.
• Hunt for signs of prior compromise before and after patching, especially if the server was exposed or patching was delayed.
• Review Exchange and IIS logs for suspicious authenticated requests, unusual PowerShell activity, web shell access, mailbox exports, and abnormal administrator actions.
• Enforce MFA for remote mailbox and administrative access where feasible, and reduce reliance on password-only authentication.
• Audit privileged groups, Exchange role assignments, mail transport rules, mailbox forwarding rules, and newly created accounts for unauthorized changes.
• Deploy or tune endpoint detection on Exchange servers with attention to web shell creation, suspicious child processes from IIS/Exchange services, and credential dumping behavior.
• Restrict inbound access to Exchange management interfaces and administrative endpoints to trusted networks or VPN.
• Prepare an incident response path for Exchange compromise, including credential rotation, mailbox audit review, and Active Directory containment steps.