What’s Vulnerable › Vulnerabilities

CVE-2024-21410: Microsoft Exchange Server Elevation of Privilege Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-02-15
• EPSS: 12.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-13 · updated 2026-08-10
• Weakness: CWE-287

Description

Microsoft Exchange Server Elevation of Privilege Vulnerability

Summary

CVE-2024-21410 is a critical elevation of privilege vulnerability in Microsoft Exchange Server (CVSS 9.8) that can allow an attacker to gain higher privileges on affected systems. It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation confirmed, and EPSS estimates a 12.7% probability of exploitation in the next 30 days. Microsoft Exchange Server is affected; apply the mitigations and updates specified in Microsoft's vendor guidance, or discontinue use of the product if mitigations are unavailable.

CVE-2024-21410 ثغرة حرجة لرفع الصلاحيات في Microsoft Exchange Server بدرجة CVSS 9.8، وقد تسمح للمهاجم بالحصول على صلاحيات أعلى على الأنظمة المتأثرة. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع تأكيد الاستغلال النشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 12.7%. المنتج المتأثر هو Microsoft Exchange Server؛ يجب تطبيق التخفيفات والتحديثات الواردة في إرشادات Microsoft، أو إيقاف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Microsoft Exchange Server: 2016-cumulative_update_23, 2019-cumulative_update_13, 2019-cumulative_update_14
• Microsoft Exchange Server 2016 Cumulative Update 23: from 15.01.0 before 15.01.2507.037 — fixed in 15.01.2507.037
• Microsoft Exchange Server 2019 Cumulative Update 13: from 15.02.0 before 15.2.1544.004 — fixed in 15.2.1544.004
• Microsoft Exchange Server 2019 Cumulative Update 14: from 15.02.0 before 15.2.1544.004 — fixed in 15.2.1544.004

How to fix

Upgrade to a fixed version: Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.037; Microsoft Exchange Server 2019 Cumulative Update 13 15.2.1544.004; Microsoft Exchange Server 2019 Cumulative Update 14 15.2.1544.004. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21410

Get alerted when CVE-2024-21410 or the next vulnerability affects your stack