CVE-2021-26427

FAQ

According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?

This vulnerability's attack is limited at the protocol level to a logically adjacent topology. This means it cannot simply be done across the internet, but instead needs something specific tied to the target. Good examples would include the same shared physical network (such as Bluetooth or IEEE 802.11), logical network (local IP subnet), or from within a secure or otherwise limited administrative domain (MPLS, secure VPN to an administrative network zone). This is common to many attacks that require machine-in-the-middle (MITM) type setups or that rely on initially gaining a foothold in another environment.

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

To exploit this vulnerability, the attacker is making specific requests over an adjacent network. This normally means as part of the same shared physical network (such as Bluetooth or IEEE 802.11), logical network (local IP subnet), or from within a secure or otherwise limited administrative domain (MPLS, secure VPN to an administrative network zone). From this point the attack allows changes to be made within the target Exchange server. The scope change is due to the attack on the network level triggering an effect on the OS level of the target system.