CVE-2021-34473

CRITICAL KEV RANSOMWARE NUCLEI

Microsoft Exchange ProxyShell RCE

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2021-34473 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 15 public exploits from researchers including horizon3ai, cyberheartmi9, kh4sh3i, including a Metasploit module exploits/windows/http/exchange_proxyshell_rce. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a functional exploit for the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) affecting Microsoft Exchange Server. The exploit automates the attack chain, including email enumeration, LegacyDN discovery, and remote code execution via PowerShell remoting.

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Exploits (15)

nomisec WORKING POC 119 stars
by horizon3ai · remote
https://github.com/horizon3ai/proxyshell

This repository contains a functional exploit for the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) affecting Microsoft Exchange Server. The exploit automates the attack chain, including email enumeration, LegacyDN discovery, and remote code execution via PowerShell remoting.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server (2013, 2016, 2019)
No auth needed
Prerequisites: Network access to vulnerable Exchange server · Unpatched Exchange Server (pre-July 2021 updates)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 47 stars
by cyberheartmi9 · remote
https://github.com/cyberheartmi9/Proxyshell-Scanner

The repository contains a scanner for detecting the Proxyshell vulnerability (CVE-2021-34473) in Microsoft Exchange Server. It includes a Python script and a Nuclei template to check for the presence of the vulnerability by sending a crafted HTTP request and checking for specific response headers.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Exchange Server
No auth needed
Prerequisites: Network access to the target Exchange Server
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 41 stars
by kh4sh3i · remote
https://github.com/kh4sh3i/ProxyShell

This repository contains a functional exploit for CVE-2021-34473, part of the ProxyShell vulnerability chain affecting Microsoft Exchange Server. The exploit leverages authentication bypass and arbitrary file write vulnerabilities to achieve remote code execution (RCE).

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server 2013, 2016, 2019 (various CUs)
No auth needed
Prerequisites: Network access to vulnerable Exchange Server · Exchange Server with unpatched ProxyShell vulnerabilities
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 30 stars
by p2-98 · poc
https://github.com/p2-98/CVE-2021-34473

This repository contains a functional exploit for CVE-2021-34473, a vulnerability in Microsoft Exchange Server. The exploit leverages the ProxyShell attack chain to achieve remote code execution (RCE) by abusing the autodiscover endpoint and PowerShell remoting.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server (versions affected by ProxyShell)
No auth needed
Prerequisites: Network access to the Exchange Server · Exchange Server vulnerable to ProxyShell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 17 stars
by je6k · remote
https://github.com/je6k/CVE-2021-34473-Exchange-ProxyShell

This repository contains functional exploit code for CVE-2021-34473, a vulnerability in Microsoft Exchange Server (ProxyShell). The exploit leverages authentication bypass and arbitrary file write to deliver a webshell via crafted email attachments.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server 2013/2016/2019
No auth needed
Prerequisites: Network access to vulnerable Exchange server · Valid email address for SID token retrieval
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 6 stars
by RaouzRouik · poc
https://github.com/RaouzRouik/CVE-2021-34473-scanner

This repository provides a scanner for detecting CVE-2021-34473, a Microsoft Exchange vulnerability. It includes batch scripts for single and mass scanning but does not contain exploit code.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Exchange Server 2013, 2016, 2019
No auth needed
Prerequisites: Network access to target Exchange servers
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 2 stars
by ipsBruno · infoleak
https://github.com/ipsBruno/CVE-2021-34473-NMAP-SCANNER

This repository provides an Nmap script to scan for CVE-2021-34473, a vulnerability in Microsoft Exchange Server. It does not include exploit code but offers a detection mechanism via NSE script.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Exchange Server (versions affected by CVE-2021-34473)
No auth needed
Prerequisites: Nmap installed · Network access to target systems
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by Loqueseamevaleverg · poc
https://github.com/Loqueseamevaleverg/ProxyHell

This repository contains a functional exploit for CVE-2021-34473 (ProxyShell), which chains multiple vulnerabilities to achieve remote code execution on Microsoft Exchange servers. The exploit leverages Autodiscover endpoint manipulation, SID leakage, and token forgery to deploy a webshell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server (versions affected by ProxyShell)
No auth needed
Prerequisites: valid target email address · network access to Exchange server
devstral-2 · analyzed Mar 16, 2026 Full analysis →
nomisec WORKING POC
by f4alireza · remote
https://github.com/f4alireza/CVE

This repository contains functional exploit code for CVE-2021-34473, a remote code execution vulnerability in Microsoft Exchange Server. The provided scripts encode a malicious payload to bypass security mechanisms and achieve RCE via a crafted HTTP request.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server (ProxyShell vulnerability)
No auth needed
Prerequisites: Network access to vulnerable Exchange Server · Exchange Server with unpatched ProxyShell vulnerability
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Orange Tsai, Jang (@testanull), PeterJson, brandonshi123, mekhalleh (RAMELLA Sébastien), Donny Maasland, Rich Warren, Spencer McIntyre, wvu · rubypocwindows
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxyshell_rce.rb

This Metasploit module exploits CVE-2021-34473, part of the ProxyShell vulnerability chain, to achieve remote code execution on Microsoft Exchange Server by bypassing authentication, impersonating a user, and writing arbitrary files.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server (2013 CU23 < 15.0.1497.15, 2016 CU19 < 15.1.2176.12, 2016 CU20 < 15.1.2242.5, 2019 CU8 < 15.2.792.13, 2019 CU9 < 15.2.858.9)
No auth needed
Prerequisites: Network access to the Exchange server · A known email address for the organization (optional)
devstral-2 · analyzed Apr 24, 2026 Full analysis →
patchapalooza SCANNER
by learningsurface · remote
https://github.com/learningsurface/ProxyShell-CVE-2021-34473.py

This repository contains a scanner for CVE-2021-34473 (ProxyShell) that checks for vulnerable Microsoft Exchange servers by sending a crafted HTTP request to the autodiscover endpoint and analyzing the response for specific indicators of vulnerability.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Microsoft Exchange Server
No auth needed
Prerequisites: Target URL or list of URLs to scan
devstral-2 · analyzed Feb 26, 2026 Full analysis →
patchapalooza WORKING POC
by aravazhimdr · remote
https://github.com/aravazhimdr/ProxyShell-POC-Mod

This repository contains a functional exploit for ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), a chain of vulnerabilities in Microsoft Exchange Server. The exploit merges two existing PoCs to achieve remote code execution (RCE) by leveraging authentication bypass and arbitrary file write vulnerabilities.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server 2016, 2019
No auth needed
Prerequisites: Network access to vulnerable Exchange server · Valid email address on the target server
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by Udyz · remote
https://github.com/Udyz/proxyshell-auto

This repository contains a functional exploit for CVE-2021-34473 (ProxyShell), which is a remote code execution vulnerability in Microsoft Exchange Server. The exploit automates the attack chain, including authentication bypass, arbitrary file write, and remote command execution as SYSTEM.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server (2013, 2016, 2019)
No auth needed
Prerequisites: Network access to Exchange Server · Exchange Server with vulnerable Autodiscover endpoint
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by dmaasland · remote
https://github.com/dmaasland/proxyshell-poc

This repository contains functional exploit code for CVE-2021-34473 (ProxyShell), demonstrating remote code execution (RCE) on Microsoft Exchange Server. The scripts include enumeration, authentication bypass, and RCE capabilities via PowerShell remoting.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server 2013, 2016, 2019
No auth needed
Prerequisites: Network access to Exchange Server · Autodiscover endpoint accessible
devstral-2 · analyzed Feb 23, 2026 Full analysis →
patchapalooza WORKING POC
by ktecv2000 · remote
https://github.com/ktecv2000/ProxyShell

This repository contains a functional exploit for CVE-2021-34473 (ProxyShell), which chains multiple vulnerabilities in Microsoft Exchange Server to achieve unauthenticated remote code execution. The exploit follows a multi-stage attack, including SSRF, SID manipulation, and PowerShell remoting to deploy a webshell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Exchange Server (2013, 2016, 2019)
No auth needed
Prerequisites: Network access to the Exchange Server · Valid email address associated with the target
devstral-2 · analyzed Feb 23, 2026 Full analysis →

Nuclei Templates (1)

Exchange Server - Remote Code Execution
CRITICALby arcc,intx0x80,dwisiswant0,r3dg33k
Shodan: vuln:cve-2021-26855 || http.favicon.hash:1768726119 || http.title:"outlook" || cpe:"cpe:2.3:a:microsoft:exchange_server"
FOFA: title="outlook" || icon_hash=1768726119

Scores

CVSS v3 9.1
EPSS 0.9421
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact total

Details

CISA KEV 2021-11-03
VulnCheck KEV 2021-08-30
InTheWild.io 2021-08-24
ENISA EUVD EUVD-2021-21128
Ransomware Use Confirmed
CWE
CWE-918
Status published
Products (3)
microsoft/exchange_server 2013 cumulative_update_23
microsoft/exchange_server 2016 cumulative_update_19 (2 CPE variants)
microsoft/exchange_server 2019 cumulative_update_8 (2 CPE variants)
Published Jul 14, 2021
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026