Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Microsoft Exchange Server Spoofing Email Risk

CVE-2021-41349 · published 4 years ago
Summary

An attacker can send fake emails that appear to come from trusted sources, potentially leading to phishing or malware attacks. This affects Microsoft Exchange Server users who rely on email verification and authentication. To protect your business, ensure you have the latest updates and security patches installed.

What to do
  • Update microsoft microsoft exchange server 2013 cumulative update 23 to version 15.00.1497.026 or later.
  • Update microsoft microsoft exchange server 2016 cumulative update 21 to version 15.01.2308.020 or later.
  • Update microsoft microsoft exchange server 2016 cumulative update 22 to version 15.01.2375.017 or later.
  • Update microsoft microsoft exchange server 2019 cumulative update 10 to version 15.02.0792.019 or later.
  • Update microsoft microsoft exchange server 2019 cumulative update 11 to version 15.02.0986.014 or later.
Affected software
VendorProductAffected versions
microsoft microsoft exchange server 2013 cumulative update 23 < 15.00.1497.026
microsoft microsoft exchange server 2016 cumulative update 21 < 15.01.2308.020
microsoft microsoft exchange server 2016 cumulative update 22 < 15.01.2375.017
microsoft microsoft exchange server 2019 cumulative update 10 < 15.02.0792.019
microsoft microsoft exchange server 2019 cumulative update 11 < 15.02.0986.014
microsoft exchange_server 2013
2016
2019
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
Original advisory text
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
93% chance of attack within 30 days
Timeline
Published10 Nov 2021
Updated29 Sep 2026
First seen19 Aug 2026
Sources
CVE-2021-41349 · NVD
CVE-2021-41349 · MITRE
Track software like this
Free during beta