Loading story…
Microsoft Exchange Server was found to contain CVE-2021-34473, a critical flaw in the Autodiscover service that allows server-side request forgery (SSRF) and authentication bypass against Exchange Server 2013, 2016, and 2019 on x64 systems. According to Zero Day Initiative, the bug stems from improper URI validation before the service accesses resources, enabling remote, unauthenticated exploitation. Microsoft issued security updates for the vulnerability, while the CVE record assigns it a CVSS v3.1 score of 9.1 and ZDI rated the issue 10.0.
Although the flaw can be described as an SSRF and auth bypass on its own, advisories note it can be chained with additional Exchange vulnerabilities to achieve arbitrary code execution as SYSTEM, placing it in the exploitation context widely associated with ProxyShell. The issue was reported to Microsoft by orangetw, later disclosed through coordinated advisories from Microsoft and ZDI, and remains a high-priority patching concern because it can be exploited remotely without authentication on exposed Exchange deployments.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository published an Exchange_SSRF_Attacks.py tool and exploitation guide showing how to abuse Exchange autodiscover and EWS SSRF behavior to enumerate valid email accounts, search contacts and emails, and download mailbox contents including attachments. The material provided example HTTP requests and command-line usage for these attacks.
The CVE record for CVE-2021-34473 was published, identifying a critical Microsoft Exchange Server vulnerability and linking it to Microsoft's advisory.
The Microsoft Exchange Server Autodiscover SSRF/authentication bypass vulnerability tracked as CVE-2021-34473 was reported to Microsoft, with orangetw credited for the discovery/report.
The CVE record for CVE-2021-34473 was updated in the CVE database.
Zero Day Initiative published advisory ZDI-21-821 in a coordinated public release for CVE-2021-34473, describing the flaw as an Exchange Autodiscover SSRF/authentication bypass that could be chained for SYSTEM-level code execution. The advisory also stated that Microsoft had released an update to address the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcegithub.com
Open sourcezerodayinitiative.com
Open sourceportal.msrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Microsoft Exchange Server flaw, **CVE-2021-34473**, enabled unauthenticated attackers to reach privileged backend services through improper URI validation and URL normalization in the Client Access Service and autodiscover functionality. The bug is the first stage of the **ProxyShell** attack chain and has been widely tied to in-the-wild exploitation, with affected builds including Exchange Server 2013 `CU23`, Exchange Server 2016 `CU19` and `CU20`, and Exchange Server 2019 `CU8` and `CU9`. Attackers have used the issue to bypass authentication, access Exchange PowerShell, read mailboxes, deploy webshells, exfiltrate email, and move laterally, especially when chaining it with **CVE-2021-34523** and **CVE-2021-31207** for full compromise. Public exploitation resources, including GitHub tooling and scanning templates, lowered the barrier to abuse, while defenders were urged to apply Microsoft's security updates, hunt for webshell indicators and suspicious autodiscover requests, monitor for PowerShell launched by `w3wp.exe`, and reduce external exposure of Exchange services.
Jun 29, 2026
Researchers detailed **ProxyShell**, a chain of Microsoft Exchange vulnerabilities that can be combined to bypass authentication, escalate privileges, and achieve remote code execution on exposed Exchange servers. Orange Tsai described the attack surface and showed how flaws including `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` could be chained to reach backend Exchange services and execute attacker-controlled code without valid credentials. Mandiant later reported real-world exploitation of ProxyShell against internet-facing Exchange environments, showing that attackers used the chain to gain shells on compromised servers and establish persistent access. The reporting underscores that unpatched on-premises Exchange systems remained a high-value target because successful exploitation could hand attackers direct control of email infrastructure, enable follow-on intrusion activity, and expose sensitive enterprise communications.
Jul 12, 2026
Attackers exploited the **ProxyNotShell** chain on on-premises Microsoft Exchange Server by combining `CVE-2022-41040`, an authenticated SSRF flaw, with `CVE-2022-41082`, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server **2013, 2016, and 2019** were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused `WSMAN` and XML SOAP traffic to establish remote shell access. Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including `193.149.185.52:443` and `sync.service.auzreservices.com`, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Jun 29, 2026