CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft Exchange Server Arbitrary File Write and Remote Code Execution Vulnerability (CVE-2021-27065, ProxyLogon)
[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019 without the latest Cumulative Updates (CU) and Security Updates (SU)
[Impact] Unauthenticated remote attackers can bypass authentication, abuse Exchange Admin Center (EAC) APIs to write arbitrary files, and execute malicious code with SYSTEM privileges
[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU), and perform a thorough compromise assessment
Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability (ProxyLogon SSRF) - CVE-2021-26855
[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019
[Impact] Unauthenticated remote attackers can bypass authentication, access sensitive mailbox data, and chain with other vulnerabilities to execute arbitrary code (RCE)
[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (SU), or implement IIS URL Rewrite rules to block malicious requests