CVE-2021-42321

This vulnerability is like a hidden “back door” in your email server software: a remote attacker can potentially run their own code on the machine that runs Microsoft Exchange Server. If that happens, they may be able to take over the server, steal email/data, or knock the system offline. Because it has been used in ransomware attacks, it’s the kind of issue that small businesses should treat as urgent.

This matters if you run Microsoft Exchange Server (including Microsoft Exchange Server 2016 cumulative updates and Microsoft Exchange Server 2019 cumulative updates listed here). It’s a remote code execution flaw that attackers can trigger over the network with low required authentication, and it does not require you to click anything. If you can reach your Exchange Server from the internet (or otherwise allow network access that could reach the vulnerable component), you should assume this is reachable—especially given that it has been exploited in ransomware campaigns.

This is RED because this vulnerability has been confirmed as exploited in real-world ransomware campaigns (CISA KEV) and public exploits exist. Attackers actively use this kind of flaw to seize servers and then spread ransomware or steal data. You should prioritize patching Exchange Server immediately.