CVE-2021-42321

What it actually does

CVE-2021-42321 is an authenticated remote code execution vulnerability in on-premises Microsoft Exchange Server. An attacker with valid Exchange credentials can send crafted requests over the network to trigger vulnerable server-side processing and execute code on the Exchange server. Because Exchange commonly runs with high privileges and has access to mailboxes, authentication material, address books, and internal network connectivity, successful exploitation can result in full compromise of the Exchange host and high-impact confidentiality, integrity, and availability loss.

Why it matters to the business

This vulnerability directly threatens email availability and confidentiality. Exploitation can allow attackers to steal mail, deploy web shells, harvest credentials, move laterally, and stage ransomware from a highly trusted server. It is listed in CISA KEV, has been observed exploited in the wild, is associated with ransomware activity, and had a CISA remediation deadline of 2021-12-01, making any remaining unpatched Exchange exposure a high-priority operational risk. The high EPSS score indicates a strong likelihood of exploitation against exposed vulnerable systems.

How an attack unfolds

An attacker first obtains valid Exchange credentials, often through phishing, password reuse, credential stuffing, prior compromise, or exposed accounts. The attacker then authenticates to the Exchange server over reachable HTTPS services such as OWA, ECP, EWS, or related Exchange endpoints and sends a crafted request that reaches the vulnerable Exchange code path. If the server is unpatched, the crafted input can cause server-side code execution under the Exchange/IIS service context. From there, the attacker commonly establishes persistence with a web shell or scheduled task, runs discovery commands, dumps credentials or mailbox data, disables defenses, and may use the Exchange server as a staging point for lateral movement or ransomware deployment.

How to fix it

Install the applicable Microsoft Exchange Server security updates from November 2021 or later for all supported Exchange versions and cumulative update levels. If the server is on an unsupported cumulative update, first upgrade to a supported Exchange cumulative update and then apply the latest Exchange security update. Because fixed package versions were not provided in the input, use Microsoft’s current Exchange Server build and security update matrix to verify the exact target build for Exchange 2013, 2016, or 2019 where applicable. Restrict external access to Exchange administrative surfaces such as ECP and PowerShell, require MFA for all remote access, disable or tightly control legacy authentication, and ensure Exchange is not exposed unnecessarily to the internet. If compromise is suspected, patching alone is insufficient: isolate the server, preserve forensic evidence, remove persistence, rotate credentials, and rebuild from trusted media if integrity cannot be established.

How to confirm the fix worked

Confirm that every on-premises Exchange server is running a supported cumulative update with the November 2021 security update or a later security update installed. Use Exchange Management Shell commands such as Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion and compare the reported build numbers against Microsoft’s official Exchange Server build matrix. Run Microsoft’s Exchange Health Checker script to identify missing security updates, unsupported cumulative updates, risky configuration, and exposure. Validate that OWA, ECP, EWS, and PowerShell virtual directories are not unnecessarily exposed and that administrative access is restricted. After patching, verify services start correctly, mail flow works, and vulnerability scanners no longer report CVE-2021-42321 exposure. For systems that were internet-facing before remediation, perform compromise assessment rather than assuming patch success means no prior exploitation.

Typical attack path

1. Identify an internet-facing or otherwise reachable on-premises Microsoft Exchange Server.
2. Obtain valid Exchange or domain credentials through phishing, credential theft, password spraying, or prior compromise.
3. Authenticate to Exchange services over HTTPS.
4. Send crafted requests that trigger the vulnerable remote code execution path.
5. Execute commands on the Exchange server under the Exchange/IIS service context.
6. Drop persistence such as a web shell, backdoor, service, or scheduled task.
7. Collect mail data, credentials, address books, configuration secrets, and domain information.
8. Move laterally using harvested credentials or trusted Exchange server access.
9. Deploy additional payloads, exfiltrate data, or stage ransomware.

How to detect it

Investigate whether vulnerable Exchange servers were accessed or modified before patching. Review IIS logs for unusual authenticated requests to Exchange endpoints such as /owa/, /ecp/, /ews/, /autodiscover/, /mapi/, and /powershell/, especially from unfamiliar IP addresses or accounts with abnormal access patterns. Review Windows Application logs for Exchange and .NET errors containing BinaryFormatter.Deserialize, SerializationException, or MSExchange Common around suspicious request times. Review Windows Security logs for unusual logons, privilege use, service creation, and process execution events, including 4624, 4627, 4672, 4688, 4697, 7045, and 1102 where available. Review PowerShell Operational logs, especially 4103 and 4104, for encoded commands, downloader commands, credential access, or mailbox export activity. Review Sysmon or EDR telemetry for w3wp.exe, UMWorkerProcess.exe, or Exchange service processes spawning shells, scripting engines, download utilities, or credential tools. Search Exchange and IIS web directories for unexpected ASPX, ASHX, config, DLL, or script files with creation times after suspicious access. Look for signs of ransomware staging, data compression, archive creation, bulk mailbox access, security tool tampering, and outbound connections from Exchange servers to unknown infrastructure. Because this is a post-authentication vulnerability, correlate exploitation indicators with successful account logons and consider credential theft or misuse as part of the investigation.

• BinaryFormatter.Deserialize
• System.Runtime.Serialization.SerializationException
• MSExchange Common
• C:\Windows\System32\inetsrv\w3wp.exe
• w3wp.exe
• UMWorkerProcess.exe
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c
• certutil.exe -urlcache
• bitsadmin /transfer
• rundll32.exe
• regsvr32.exe
• mshta.exe
• C:\inetpub\wwwroot\aspnet_client\system_web\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\
• /owa/auth/
• /ecp/
• /powershell/
• ParentImage=C:\Windows\System32\inetsrv\w3wp.exe Image=C:\Windows\System32\cmd.exe
• ParentImage=C:\Windows\System32\inetsrv\w3wp.exe Image=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• ParentImage=C:\Windows\System32\inetsrv\w3wp.exe Image=C:\Windows\System32\certutil.exe
• EventCode=7045
• EventCode=4688
• EventCode=4104

What your security team should do

• Immediately identify all on-premises Microsoft Exchange servers, including legacy, disaster recovery, hybrid, lab, and decommissioned-but-powered-on systems.
• Prioritize emergency remediation for any Exchange server missing the November 2021 or later security update, especially internet-facing systems.
• Treat unpatched historical exposure as a potential compromise because the vulnerability is in CISA KEV, has active exploitation, and is associated with ransomware activity.
• Review Exchange, IIS, Windows Security, PowerShell, Sysmon/EDR, and web server file-system artifacts for exploitation and post-exploitation activity.
• Hunt for abnormal child processes spawned by w3wp.exe or Exchange services, especially cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, rundll32.exe, regsvr32.exe, and mshta.exe.
• Search Exchange web directories for newly created or modified ASPX files and other unexpected executable content.
• Rotate credentials for accounts that authenticated to vulnerable Exchange servers during the exposure window, prioritizing privileged and service accounts.
• Restrict external access to ECP and Exchange PowerShell, enforce MFA, and disable legacy authentication where possible.
• If web shells, suspicious process execution, credential theft, or ransomware staging is found, isolate affected servers and initiate incident response rather than performing only an in-place cleanup.
• Add long-term monitoring for Exchange exploitation patterns, suspicious web content creation, and anomalous authenticated access to mail services.