CVE-2021-33766

What it actually does

CVE-2021-33766 is a remotely reachable Microsoft Exchange Server flaw in the Exchange Control Panel/Exchange admin web components that can allow an unauthenticated attacker to bypass expected authentication handling and access or modify mailbox-related configuration. In practical exploitation, the issue has been associated with abuse of ECP/RulesEditor endpoints to read or change mailbox settings, including inbox rules or forwarding behavior, creating an information-disclosure path and limited integrity impact without needing valid credentials. Because Exchange is commonly internet-facing and handles high-value email data, successful exploitation can expose sensitive communications and enable follow-on phishing, fraud, or internal reconnaissance.

Why it matters to the business

An attacker may be able to access or redirect email for targeted mailboxes, exposing confidential messages, invoices, legal correspondence, credentials, reset links, or business communications. This can lead to data leakage, business email compromise, fraud, regulatory reporting obligations, and loss of trust. The vulnerability is in CISA KEV, has a very high EPSS score, and is listed as actively exploited in the wild; the CISA remediation due date of 2022-02-01 has long passed, so any remaining unpatched Exchange exposure should be treated as urgent legacy risk.

How an attack unfolds

An attacker first identifies an internet-accessible Microsoft Exchange Server and confirms ECP-related endpoints are reachable. The attacker then sends crafted HTTP requests to Exchange Control Panel paths that cause the front-end and back-end Exchange components to mishandle authentication state. If successful, the attacker can interact with mailbox configuration endpoints without valid user credentials. A common objective is to enumerate or alter inbox rule configuration, such as adding forwarding or redirection rules for a targeted mailbox, allowing future mail to be copied to an attacker-controlled address. After establishing mail access or redirection, the attacker may monitor communications, capture password reset messages or sensitive documents, perform business email compromise, or use the compromised mailbox context to support further intrusion. No reliable named threat actor attribution is provided in the input beyond active exploitation context, so defenders should treat this as broadly opportunistic Exchange exploitation rather than a single-campaign issue.

How to fix it

Install the Microsoft Exchange Server security updates that include the July 2021 fix for CVE-2021-33766 or any later supported cumulative/security update for the affected Exchange branch. No exact fixed package versions were supplied in the input, so use Microsoft’s current Exchange Server build documentation and the Exchange Health Checker script to verify that each server is on a supported cumulative update with all applicable security updates installed. Remove or upgrade unsupported Exchange versions. Restrict external access to ECP and administrative Exchange endpoints wherever possible, placing them behind VPN, conditional access, or trusted administrative networks. Review mailbox forwarding, inbox rules, transport rules, and delegate permissions for unauthorized changes. If exploitation is suspected, perform incident response in addition to patching because patching does not remove malicious forwarding rules or address already-exfiltrated email.

How to confirm the fix worked

Confirm remediation by verifying Exchange build numbers against Microsoft’s fixed and supported Exchange Server build matrix and by running the Microsoft Exchange Health Checker script. Validate that ECP administrative endpoints are not anonymously accessible and, where business requirements allow, are not exposed directly to the internet. Review IIS and Exchange HttpProxy logs for suspicious ECP/RulesEditor requests before and after patching. Confirm that newly created or modified mailbox forwarding rules, inbox rules, and delegate permissions are authorized. Test from an unauthenticated external network location that crafted requests to ECP/RulesEditor endpoints receive normal authentication challenges or access-denied responses rather than mailbox-rule service responses.

Typical attack path

1. Scan for internet-facing Microsoft Exchange Server instances with reachable Outlook Web App/ECP services.
2. Identify Exchange version/build or infer vulnerable exposure from response headers, paths, or behavior.
3. Send crafted unauthenticated HTTP requests to ECP/RulesEditor mailbox-configuration endpoints.
4. Bypass expected authentication handling between Exchange front-end and back-end components.
5. Read or modify mailbox configuration, commonly inbox rules or forwarding settings.
6. Redirect or copy victim mailbox traffic to an attacker-controlled destination.
7. Use exposed email content for credential reset interception, business email compromise, fraud, or internal reconnaissance.
8. Attempt to remove obvious traces by deleting or altering malicious rules after useful data has been collected.

How to detect it

Look for evidence in IIS web logs, Exchange HttpProxy ECP logs, Exchange ECP application logs, mailbox audit logs, admin audit logs, and message-trace or mail-flow logs. Focus on requests to ECP RulesEditor service paths, especially NewObject, SetObject, GetList, or related inbox-rule operations from unusual external IP addresses, without normal authenticated user context, or targeting multiple mailbox identifiers. Review Windows event logs and Exchange logs around the same timestamps for authentication anomalies, application errors, and unexpected ECP activity. Hunt for newly created or modified inbox rules that forward, redirect, delete, or hide messages; external ForwardingSmtpAddress values; unusual delegate permissions; and mail flow to unfamiliar external addresses. Because exploitation may result in configuration changes rather than malware installation, absence of web shells or suspicious processes does not rule out compromise. Correlate suspicious ECP requests with subsequent outbound email forwarding, mailbox rule changes, password reset emails, invoice traffic, or user reports of missing or auto-deleted messages.

• RulesEditor/InboxRules.svc/NewObject
• RulesEditor/InboxRules.svc/SetObject
• RulesEditor/InboxRules.svc/GetList
• RulesEditor/InboxRules.svc/RemoveObject
• /ecp/
• SecurityToken=
• msExchEcpCanary=
• ForwardingSmtpAddress
• DeliverToMailboxAndForward
• ForwardTo
• RedirectTo
• DeleteMessage
• New-InboxRule
• Set-InboxRule
• Set-Mailbox -ForwardingSmtpAddress
• \Microsoft\Exchange Server\V15\Logging\HttpProxy\Ecp\
• \inetpub\logs\LogFiles\W3SVC1\

What your security team should do

• Immediately inventory all internet-facing Microsoft Exchange Servers and prioritize those exposing OWA/ECP over the internet.
• Patch or retire any Exchange Server that is not on a supported cumulative update with security updates newer than the July 2021 release.
• Treat unpatched systems as potentially compromised because the vulnerability is KEV-listed, actively exploited, and has a very high EPSS probability.
• Restrict ECP and Exchange administrative interfaces to trusted networks or VPN-accessible management paths.
• Hunt for suspicious ECP/RulesEditor activity in IIS, Exchange HttpProxy, and ECP logs, especially unauthenticated requests or unusual mailbox-targeted paths.
• Audit all mailbox forwarding settings, inbox rules, transport rules, and delegate permissions for unauthorized external recipients.
• Investigate suspicious forwarding destinations as potential data-exfiltration channels and preserve logs before rotation.
• If signs of exploitation exist, perform mailbox-content exposure assessment, reset potentially exposed credentials, and review downstream fraud/BEC risk.