ProxyShell is the name for three Microsoft Exchange Server vulnerabilities, CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. Chained together, they let an unauthenticated attacker run arbitrary commands on Exchange Server through an exposed port 443. Orange Tsai of DEVCORE demonstrated the chain at Pwn2Own Vancouver 2021, and CISA warned of active exploitation in August 2021.
Updated
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2021-34473KEV Microsoft Exchange Server Remote Code Execution Vulnerability | Microsoft Exchange Server Remote Code Execution Vulnerability | Microsoft | 9.1 | 100.0% | KEV | 2021-07-14 |
| CVE-2021-34523KEV Microsoft Exchange Server Elevation of Privilege Vulnerability | Microsoft Exchange Server Elevation of Privilege Vulnerability | Microsoft | 9.0 | 100.0% | KEV | 2021-07-14 |
| CVE-2021-31207KEV Microsoft Exchange Server Security Feature Bypass Vulnerability | Microsoft Exchange Server Security Feature Bypass Vulnerability | Microsoft | 6.6 | 99.8% | KEV | 2021-05-11 |
Microsoft Exchange Server Remote Code Execution Vulnerability
Part of the ProxyShell chain: this is the remote code execution flaw in Microsoft Exchange Server, the highest rated of the three. DEVCORE's Orange Tsai demonstrated the chain at Pwn2Own 2021, and CISA warned of active exploitation in August 2021.
Microsoft Exchange Server Privilege Escalation Vulnerability
Part of the ProxyShell chain: this is the Exchange Server elevation of privilege flaw. CISA listed it with CVE-2021-34473 and CVE-2021-31207 as the ProxyShell vulnerabilities under active exploitation in August 2021.
Microsoft Exchange Server Security Feature Bypass Vulnerability
Part of the ProxyShell chain: this is the Exchange Server security feature bypass flaw. Tenable notes it was rated less likely to be exploited on its own, but chained with the other two it enables code execution.
| CVE | Added | Due | Ransomware |
|---|---|---|---|
| CVE-2021-34473 | 2021-11-03 | 2021-11-17 | Known use |
| CVE-2021-34523 | 2021-11-03 | 2021-11-17 | Known use |
| CVE-2021-31207 | 2021-11-03 | 2021-11-17 | Known use |
| CVE | Vendor | Product | Versions |
|---|---|---|---|
| CVE-2021-34473 | Microsoft | Microsoft Exchange Server 2013 Cumulative Update 23 | 15.00.0 to <15.00.1497.015 |
| CVE-2021-34473 | Microsoft | Microsoft Exchange Server 2016 Cumulative Update 19 | 15.01.0 to <15.01.2176.012 |
| CVE-2021-34473 | Microsoft | Microsoft Exchange Server 2016 Cumulative Update 20 | 15.01.0 to <15.01.2242.008 |
| CVE-2021-34473 | Microsoft | Microsoft Exchange Server 2019 Cumulative Update 8 | 15.02.0 to <15.02.0792.013 |
| CVE-2021-34473 | Microsoft | Microsoft Exchange Server 2019 Cumulative Update 9 | 15.02.0 to <15.02.0858.010 |
| CVE-2021-34523 | Microsoft | Microsoft Exchange Server 2013 Cumulative Update 23 | 15.00.0 to <15.00.1497.015 |
| CVE-2021-34523 | Microsoft | Microsoft Exchange Server 2016 Cumulative Update 19 | 15.01.0 to <15.01.2176.012 |
| CVE-2021-34523 | Microsoft | Microsoft Exchange Server 2016 Cumulative Update 20 | 15.01.0 to <15.01.2242.008 |
| CVE-2021-34523 | Microsoft | Microsoft Exchange Server 2019 Cumulative Update 8 | 15.02.0 to <15.02.0792.013 |
| CVE-2021-34523 | Microsoft | Microsoft Exchange Server 2019 Cumulative Update 9 | 15.02.0 to <15.02.0858.010 |
| CVE-2021-31207 | Microsoft | Microsoft Exchange Server 2013 Cumulative Update 23 | 15.00.0 to <15.00.1497.018 |
| CVE-2021-31207 | Microsoft | Microsoft Exchange Server 2019 Cumulative Update 9 | 15.02.0 to <15.02.0858.012 |
| CVE-2021-31207 | Microsoft | Microsoft Exchange Server 2016 Cumulative Update 20 | 15.01.0 to <15.01.2242.010 |
| CVE-2021-31207 | Microsoft | Microsoft Exchange Server 2016 Cumulative Update 19 | 15.01.0 to <15.01.2176.014 |
| CVE-2021-31207 | Microsoft | Microsoft Exchange Server 2019 Cumulative Update 8 | 15.02.0 to <15.02.0792.015 |
ProxyShell is the name for three Microsoft Exchange Server vulnerabilities, CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. Chained together, they let an unauthenticated attacker run arbitrary commands on Exchange Server through an exposed port 443. Orange Tsai of DEVCORE demonstrated the chain at Pwn2Own Vancouver 2021, and CISA warned of active exploitation in August 2021.
ProxyShell covers three CVEs: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.
3 of the 3 ProxyShell CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-11-03: CVE-2021-34473 (added 2021-11-03), CVE-2021-34523 (added 2021-11-03), and CVE-2021-31207 (added 2021-11-03).
The highest CVSS base score among the ProxyShell CVEs is 9.1 (CRITICAL), for CVE-2021-34473.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.