CVE-2021-27078: 
vulnerability analysis and mitigation

Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-27078) was disclosed on March 2, 2021. This vulnerability affects multiple versions of Microsoft Exchange Server including Exchange Server 2019 (Cumulative Updates 7 and 8), Exchange Server 2016 (Cumulative Updates 18 and 19), and Exchange Server 2013 (Cumulative Update 23) (NVD, Microsoft KB).

The vulnerability has received varying CVSS severity ratings. Microsoft Corporation assigned it a CVSS v3.1 base score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, while the NVD assessment rated it at 7.2 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The CVSS v2.0 base score is 6.5 (MEDIUM) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute code remotely on affected Exchange Server systems, potentially compromising the confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires high privileges for exploitation and no user interaction. It can be accessed through the network vector (NVD).

Microsoft has released security updates to address this vulnerability. The patches are available through Windows Update, Microsoft Update Catalog, and as standalone packages for different versions of Exchange Server. Organizations should apply the relevant security update (KB5000871) for their specific Exchange Server version and cumulative update level (Microsoft KB).