Critical Remote Code Execution in Microsoft Exchange Server (CVE‑2021‑42321)
What It Is – Microsoft disclosed CVE‑2021‑42321, a remote‑code‑execution flaw in on‑premises Microsoft Exchange Server. The vulnerability stems from improper validation of cmdlet arguments, allowing an attacker who has a valid Exchange account to execute arbitrary commands on the server.
Exploitability – The flaw is authenticated; an attacker must first obtain legitimate Exchange credentials. Public proof‑of‑concept code exists, and the CVSS v3.1 base score is 9.8 (Critical).
Affected Products – Microsoft Exchange Server (all supported on‑prem versions prior to the security update released March 2022).
Why It Matters for Trust & Control Assurance
- Highlights a gap in privileged‑access validation, a core control objective that underpins audit‑ready identity management.
- Demonstrates the need for continuous monitoring of admin cmdlet activity to provide defensible evidence of control effectiveness.
- Failure to remediate can be cited in compliance reviews as a weakness in access‑control governance across frameworks (e.g., NIST CSF, ISO 27001).
Recommended Actions
- Deploy Microsoft’s patch for CVE‑2021‑42321 without delay.
- Enforce multi‑factor authentication for all Exchange administrative accounts.
- Enable detailed command‑line and PowerShell logging; feed logs into a SIEM for real‑time anomaly detection.
- Review and tighten least‑privilege assignments for service and admin accounts.
Source: CISA KEV – CVE‑2021‑42321