CVE-2021-31207: Microsoft Exchange Server Security Feature Bypass Vulnerability
Published May 11, 2021
·Updated
Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.
Other sources
Microsoft Exchange Server Security Feature Bypass Vulnerability
— Microsoft
Affected Software
11 affected componentsFixes available
Microsoft Exchange Server 2016=20
Microsoft Exchange Server 2016=19
Microsoft Exchange Server 2013=23
Microsoft Exchange Server
Microsoft Exchange Server 2019=9
Microsoft Exchange Server 2019=8
Microsoft Exchange Server=2013-cumulative_update_23
Microsoft Exchange Server=2016-cumulative_update_19
Microsoft Exchange Server=2016-cumulative_update_20
Microsoft Exchange Server=2019-cumulative_update_8
Microsoft Exchange Server=2019-cumulative_update_9
Event History
May 11, 2021
CVE Published
via Microsoft·07:00 AM
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
CVE Published
via MITRE·07:11 PM
Data Sourced
via MITRE·07:11 PM
DescriptionSeverity
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 19, 2021
Advisory Published
via ZDI·12:00 AM
Data Sourced
via ZDI·12:00 AM
DescriptionSeverityAffected Software
Nov 3, 2021
Known Exploited
via CISA·12:00 AM
Known Ransomware
via CISA·12:00 AM
Jul 9, 2024
News Published
via The Register·02:33 AM
News Published
via The Register·02:36 AM
Jul 30, 2024
News Published
via BleepingComputer·12:00 PM
News Published
via BleepingComputer·12:01 PM
Feb 19, 2025
News Published
via BleepingComputer·08:55 PM
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is CVE-2021-31207?
CVE-2021-31207 is a security feature bypass vulnerability in Microsoft Exchange Server.
2
How does CVE-2021-31207 affect Microsoft Exchange Server?
CVE-2021-31207 allows remote attackers to execute arbitrary code on affected installations of Microsoft Exchange Server.
3
What is the severity of CVE-2021-31207?
CVE-2021-31207 has a severity rating of 8.8, which is classified as high severity.
4
Which versions of Microsoft Exchange Server are affected by CVE-2021-31207?
Microsoft Exchange Server 2013 (cumulative update 23), 2016 (cumulative update 19 and 20), and 2019 (cumulative update 8 and 9) are affected by CVE-2021-31207.
5
How can the authentication mechanism be bypassed in CVE-2021-31207?
CVE-2021-31207 allows bypassing the existing authentication mechanism.