CVE-2021-41349

What it actually does

CVE-2021-41349 is a Microsoft Exchange Server spoofing flaw that can expose sensitive credential material when a remote, unauthenticated attacker convinces a user to interact with crafted content. The vulnerability is network-reachable, low-complexity, and does not require the attacker to already have Exchange credentials, but it does require user interaction. Successful exploitation can result in high-impact confidentiality loss, most notably exposure of authentication data that may be reused, cracked offline, or relayed depending on surrounding controls such as NTLM restrictions, SMB signing, Extended Protection, and outbound network filtering.

Why it matters to the business

An attacker who successfully abuses this issue may obtain credential material from Exchange users and use it to access email, internal services, or other systems where the same authentication can be reused. Because Exchange is commonly exposed to the internet and holds high-value communications, exploitation can support mailbox compromise, phishing escalation, data theft, and follow-on intrusion. The EPSS score is very high and exploit maturity is listed as weaponized, so organizations should treat remaining exposure as urgent even though this CVE is not currently listed in CISA KEV and is not specifically marked as ransomware-used.

How an attack unfolds

A typical attack begins with reconnaissance to identify an organization using Microsoft Exchange Server and to select targets likely to interact with attacker-controlled content. The attacker then sends a crafted message, link, calendar item, or other lure that causes the victim or Exchange-integrated client workflow to contact attacker-controlled infrastructure. When the interaction occurs, the vulnerability allows spoofing behavior that can disclose sensitive authentication information, commonly useful as credential material rather than direct code execution. The attacker captures the credential exchange or related secret, then attempts to crack it offline, relay it to another service, or use it to impersonate the user where authentication controls allow. If successful, the attacker may access mailboxes, harvest additional credentials and sensitive messages, and pivot to other services.

How to fix it

Apply the Microsoft Exchange Server security updates that address CVE-2021-41349, specifically the November 2021 Exchange Server security updates or any later supported cumulative/security update for the installed Exchange version. Because no exact fixed versions were provided in the input, administrators should bring Exchange to a currently supported cumulative update level and then install the latest available security update from Microsoft. As compensating controls, restrict unnecessary inbound and outbound Exchange connectivity, block outbound SMB/NTLM authentication to the internet, enable Extended Protection for Exchange where supported and validated, enforce SMB signing and LDAP signing/channel binding, reduce NTLM usage where possible, and require phishing-resistant MFA for remote access and administrative accounts. Do not rely on user awareness alone; the vulnerability is designed around user interaction.

How to confirm the fix worked

Confirm all Exchange servers report an installed build level that includes the November 2021 or later Exchange security updates. Use Microsoft-supported Exchange Health Checker scripts and compare installed Exchange build numbers against Microsoft’s Exchange Server build and security update documentation. Validate that all internet-facing Exchange endpoints are patched, including hybrid, edge, lab, legacy, and disaster recovery systems. Test that outbound SMB/NTLM authentication from Exchange servers and user workstations to untrusted internet destinations is blocked or tightly controlled. Review mail-flow and web proxy behavior with a safe test message containing external resources to verify that automatic authentication to untrusted destinations is not occurring.

Typical attack path

1. Identify internet-facing Microsoft Exchange Server infrastructure and likely user targets.
2. Prepare attacker-controlled infrastructure to receive authentication attempts or sensitive responses.
3. Deliver a crafted lure, message, or link requiring user interaction.
4. Victim interacts with the crafted content, triggering the spoofing condition.
5. Capture exposed credential material or sensitive authentication data.
6. Attempt offline cracking, NTLM relay, or reuse against accessible services.
7. Use obtained access for mailbox compromise, internal reconnaissance, phishing, or lateral movement.

How to detect it

Investigate whether users were lured into interacting with suspicious messages or links that caused authentication attempts to attacker-controlled infrastructure. Useful sources include Exchange message tracking logs, IIS logs for Exchange web endpoints, OWA/ECP/EWS/ActiveSync logs, endpoint telemetry from Outlook clients, web proxy logs, DNS logs, firewall egress logs, Windows Security authentication events, and NTLM auditing logs. Look for messages containing external UNC paths, unusual external image or file references, links to newly registered domains, or URLs associated with credential-harvesting infrastructure. Correlate suspicious messages with outbound connections from user workstations or Exchange servers to unfamiliar hosts, especially SMB/NTLM-related traffic over TCP 445, 139, 80, or 443. Review authentication logs for NTLM usage to unusual destinations, failed or successful logons following phishing delivery, mailbox access from unfamiliar IP addresses, suspicious EWS activity, creation of inbox forwarding rules, and abnormal download volume. Because exploitation primarily results in credential exposure rather than a deterministic server-side artifact, detection is correlation-based and should focus on suspicious lures, outbound authentication attempts, and post-exposure account misuse.

• \\\\
• file://
• smb://
• TCP/445 outbound to internet
• TCP/139 outbound to internet
• Event ID 4624
• Event ID 4625
• Event ID 4776
• Authentication Package: NTLM
• Package Name (NTLM only): NTLM V2
• C:\\inetpub\\logs\\LogFiles\\W3SVC1
• C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging
• C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\MessageTracking
• New-InboxRule
• Set-Mailbox -ForwardingSmtpAddress
• Set-Mailbox -DeliverToMailboxAndForward

What your security team should do

• Immediately inventory all Microsoft Exchange Server instances, including internet-facing, hybrid, legacy, test, and recovery systems.
• Patch Exchange to a supported cumulative update and install the latest Microsoft Exchange security update; prioritize any internet-facing servers first.
• Run Microsoft Exchange Health Checker and confirm the server build includes the November 2021 security fix or later.
• Block outbound NTLM/SMB authentication to the internet from servers and workstations, especially Exchange servers.
• Harden authentication by reducing NTLM exposure, enabling Extended Protection where supported, and enforcing MFA for remote and privileged access.
• Review mail, proxy, DNS, and authentication logs for historical evidence of user interaction with suspicious external hosts around phishing events.
• Reset credentials and revoke sessions for users whose credential material may have been exposed or whose accounts show suspicious authentication behavior.
• Monitor for attempted NTLM relay, unusual mailbox access, suspicious inbox rules, mass mail access, and abnormal authentication from unfamiliar networks.