Microsoft Exchange ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CISA KEV): how do I tell if an old on-prem Exchange server is still exposed, and what should I do about it?

What it is: ProxyShell is a chain of three on-premises Exchange Server flaws: CVE-2021-34473 (pre-authentication path confusion that bypasses access checks), CVE-2021-34523 (privilege elevation in the Exchange PowerShell backend) and CVE-2021-31207 (a post-authentication file write). Together they let an unauthenticated attacker run code on the server, usually by dropping web shells. Microsoft patched them in the April and May 2021 updates; mass exploitation followed in August 2021, CISA issued an urgent alert and lists all three in KEV. Ransomware groups kept using them for years against unpatched servers. Am I affected: - Exchange Server 2013, 2016 or 2019 (on-premises) without the April and May 2021 security updates (or a later Cumulative Update plus its security updates). Exchange Online is not affected. - Run Microsoft's Exchange Health Checker script (HealthChecker.ps1, from the Microsoft CSS-Exchange project) on each server: it reports the build, missing security updates and known vulnerabilities. - Note that Exchange 2013 reached end of support in April 2023 and Exchange 2016/2019 in October 2025, so they no longer receive fixes for newer bugs either. Fix: 1. Install the latest Cumulative Update and security update available for your version, or better, move to a supported option (Exchange Server Subscription Edition or Exchange Online). Keep OWA/ECP and /autodiscover off the internet unless needed, or publish them through a reverse proxy with pre-authentication. 2. Hunt for compromise, especially if the server was internet-facing and unpatched in 2021 or later: unexpected .aspx files in the OWA/ECP and IIS (aspnet_client) folders, unexpected mailbox export requests (Get-MailboxExportRequest), new admin or role-group members, and the indicators in CISA's and Microsoft's guidance. Microsoft's Safety Scanner/Defender and the CSS-Exchange scripts help with this. 3. If you find web shells, treat the domain as at risk: isolate the server, rebuild it, and reset credentials for accounts used on it (including the Exchange computer account's privileges in Active Directory). Verify: HealthChecker.ps1 shows a current build with no missing security updates, and no unknown .aspx files or export requests remain. Sources: https://www.cisa.gov/news-events/alerts/2021/08/21/urgent-protect-against-active-exploitation-proxyshell-vulnerabilities https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473 https://nvd.nist.gov/vuln/detail/CVE-2021-34473