CVE-2021-31196

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Aug 10, 2026

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftMicrosoft Exchange Server 2013 Cumulative Update 23>= 15.00.0, < 15.00.1497.023
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 20>= 15.01.0, < 15.01.2242.012
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 21>= 15.01.0, < 15.01.2308.014
MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 10>= 15.02.0, < 15.02.0922.013
MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 9>= 15.02.0, < 15.02.0858.015

References

Timeline

Published
Jul 14, 2021
Last modified
Aug 10, 2026
Added to CISA KEV
Aug 21, 2024
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-311987.8Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-311995.2Microsoft Enhanced Cryptographic Provider Elevation of Privilege VulnerabilityCVE-2021-31209.8An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers CVE-2021-312007.2Common Utilities Remote Code Execution VulnerabilityCVE-2021-312015.2Microsoft Enhanced Cryptographic Provider Elevation of Privilege VulnerabilityCVE-2021-312047.3.NET and Visual Studio Elevation of Privilege VulnerabilityCVE-2021-312056.5Windows SMB Client Security Feature Bypass VulnerabilityCVE-2021-312067.6Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-312076.6Microsoft Exchange Server Security Feature Bypass VulnerabilityCVE-2021-312087.8Windows Container Manager Service Elevation of Privilege VulnerabilityCVE-2021-312096.5Microsoft Exchange Server Spoofing VulnerabilityCVE-2021-31218.6An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut
CVE-2021-31196: High severity, CVSS 7.2 | Vulnix