CVE-2021-31206

HighCVSS 7.6/10Last modified Aug 10, 2026

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Affected software

VendorProductVersions
MicrosoftMicrosoft Exchange Server 2013 Cumulative Update 23>= 15.00.0, < 15.00.1497.023
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 20>= 15.01.0, < 15.01.2242.012
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 21>= 15.01.0, < 15.01.2308.014
MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 10>= 15.02.0, < 15.02.0922.013
MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 9>= 15.02.0, < 15.02.0858.015

References

Timeline

Published
Jul 14, 2021
Last modified
Aug 10, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-312076.6Microsoft Exchange Server Security Feature Bypass VulnerabilityCVE-2021-312087.8Windows Container Manager Service Elevation of Privilege VulnerabilityCVE-2021-312096.5Microsoft Exchange Server Spoofing VulnerabilityCVE-2021-31218.6An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut CVE-2021-312117.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-312137.8Visual Studio Code Remote Containers Extension Remote Code Execution VulnerabilityCVE-2021-312147.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-312158.8SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSluCVE-2021-312168.1Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by CVE-2021-312179.1In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM.CVE-2021-31229.8CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document CVE-2021-312205.2SES Evolution before 2.1.0 allows modifying security policies by leveraging access of a user having read-only access to security policies.
CVE-2021-31206: High severity, CVSS 7.6 | Vulnix