ZeroDay Findings
Sign inSign up

Findings

CVE-2021-33766

Microsoft Exchange Server Information Disclosure

Published Jul 14, 2021 · updated Aug 10, 2026 · microsoft exchange server

Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 14, 2021 · Catalog

    Detected

    Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

  2. Jan 18, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Feb 1, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 10, 2026 · Catalog

    Updated

    Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

Required action

Apply updates per vendor instructions.

CISA due date Feb 1, 2022

Affected

  • cpe microsoft/exchange server2013
  • cpe microsoft/exchange server2016
  • cpe microsoft/exchange server2019
  • vendor Microsoft Exchange Serverversion unspecified

Sources

  • CISA KEVCVE-2021-33766

    Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

    cisa.gov
  • CVE.orgCVE-2021-33766

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-33766

    30-day exploitation probability 98.2%

    first.org
  • NIST NVDCVE-2021-33766

    Microsoft Exchange Server Information Disclosure Vulnerability

    nvd.nist.gov

References