Exchange CVE-2021-31196: ProxyOracle Padding Oracle in KEV

What to do

1. Record the exact build of every on-premises Exchange server with the Health Checker script or Exsetup.exe, not just the CU.
2. Take any server older than the July 2021 Security Update off the internet now and treat it as possibly compromised.
3. Migrate remaining Exchange 2013, 2016 and 2019 servers to Exchange Server SE or Exchange Online; none of them receive updates any more.
4. Reset passwords for users who signed in to OWA on a vulnerable server, since ProxyOracle recovers plaintext passwords.
5. Publish OWA only through a VPN, a pre-authenticating reverse proxy or an IP allowlist where you can.

How to check if you are affected or compromised

• Search IIS logs for requests to /owa/auth/frowny.aspx with script in parameters such as app or refurl, the cross-site scripting half (CVE-2021-31195) of the chain.
• Look for bursts of hundreds of OWA requests from one source that all end in 302 redirects, which fits a padding-oracle run.
• Check affected users' later sign-ins for unfamiliar locations or devices.
• On any server that ran pre-July-2021 builds, hunt for web shells in the OWA and ECP folders and for unknown administrator accounts.

What happened#

On July 13, 2021, Microsoft patched CVE-2021-31196 in Exchange Server 2013, 2016 and 2019. The update guide titles it a remote code execution bug, rates it Important with CVSS 3.1 7.2, and listed it as not exploited at release. Microsoft credits Orange Tsai of DEVCORE as the finder.

Tsai's ProxyOracle write-up explains the bug. Outlook Web Access (OWA) forms-based authentication stores the user's name and password in encrypted cadata cookies. CVE-2021-31196 is a padding oracle in how Exchange parses them. The login redirect carries reason=0 when the padding is invalid and reason=2 when the cookie decrypts to bad credentials. That difference lets an attacker decrypt any user's cookie. Paired with a reflected cross-site scripting bug, CVE-2021-31195 (patched in May 2021), that steals the cookie, the chain "allows an attacker to recover the user's password in plaintext format completely." The victim only has to open a malicious link.

Three years later, on August 21, 2024, CISA added the CVE to the KEV catalog "based on evidence of active exploitation," with a September 11, 2024 deadline. CISA calls it an information disclosure flaw, which matches the password-recovery impact better than Microsoft's title.

Who is affected#

Per the CVE record and NVD: Exchange 2013 CU23 before build 15.00.1497.023, Exchange 2016 CU20 before 15.01.2242.012 and CU21 before 15.01.2308.014, and Exchange 2019 CU9 before 15.02.0858.015 and CU10 before 15.02.0922.013. The fixes were KB5004778, KB5004779 and KB5004780. Exchange Online is not listed.

Support status now matters more than the patch. Exchange 2013 left extended support in April 2023, per its lifecycle page. Exchange 2016 and 2019 reached end of support on October 14, 2025. Paid Extended Security Updates kept them patched through 2026, but Microsoft says its October 13, 2026 release was the last. Only Exchange Server Subscription Edition (SE) still gets fixes.

Do you really need to act?#

Only if you still run an Exchange server this old, and then yes, for reasons wider than this bug. CISA did not say who exploited it or why it was listed in 2024. We found no public threat-intelligence report tying CVE-2021-31196 to a campaign as of October 23, 2026.

The Dutch DIVD case file tracked ProxyOracle with ProxyShell. It lists CVE-2021-34523 and CVE-2021-31207 as patched and documented the same day as this bug. A server that missed the July 2021 update therefore also lacks those fixes, plus every exploited Exchange fix since, including CVE-2023-21529 and CVE-2026-42897. On such a server, a stolen OWA password is the smallest risk. If you run only Exchange Online, or Exchange SE with current updates, you are not exposed.

What to do now#

1. Find exact builds. Run the Exchange Health Checker (.\HealthChecker.ps1) or Get-Command Exsetup.exe | ForEach-Object {$_.FileVersionInfo} on each server. Get-ExchangeServer shows the CU only, not Security Updates.
2. Take any server below the July 2021 builds off the internet now. Plan a rebuild and investigation, not a patch.
3. Move remaining Exchange 2013, 2016 and 2019 servers to Exchange SE or Exchange Online.
4. Reset passwords for users who signed in to OWA on a vulnerable server.
5. Where you can, publish OWA only through a VPN, a pre-authenticating reverse proxy or an IP allowlist.

How to tell if you were hit#

ProxyOracle leaves thin traces. In IIS logs, look for requests to /owa/auth/frowny.aspx with script in parameters such as app or refurl, the XSS half Tsai documented. Also look for bursts of hundreds of OWA requests from one address that all end in 302 redirects, which fits a padding-oracle run. Then check affected users' later sign-ins for unfamiliar locations. Because a server this old also missed the July 2021 ProxyShell fixes, hunt for web shells in the OWA and ECP directories and for administrator accounts nobody created.

Timeline#

• May 11, 2021 — Microsoft patches CVE-2021-31195, the XSS half of ProxyOracle.
• Jul 13, 2021 — Microsoft patches CVE-2021-31196.
• Aug 6, 2021 — Orange Tsai publishes the ProxyOracle write-up.
• Apr 2023 — Exchange 2013 reaches end of extended support.
• Aug 21, 2024 — CISA adds the CVE to KEV.
• Sep 11, 2024 — Federal remediation deadline.
• Oct 14, 2025 — Exchange 2016 and 2019 reach end of support.
• Oct 13, 2026 — Final Extended Security Update for Exchange 2016 and 2019.

Vulnerability records

• CVE-2021-31196 · KEV 2024-08-21 · Microsoft Exchange Server Remote Code Execution Vulnerability

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2021-31196 Microsoft Exchange Server Remote Code Execution Vulnerability msrc.microsoft.com
2. CVE record — CVE-2021-31196 cve.org
3. NVD — CVE-2021-31196 nvd.nist.gov
4. DEVCORE (Orange Tsai) — A New Attack Surface on MS Exchange Part 2: ProxyOracle! devco.re
5. CISA — Known Exploited Vulnerabilities: CVE-2021-31196 cisa.gov
6. CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Aug 21, 2024) cisa.gov
7. Microsoft Learn — Exchange Server 2013 lifecycle learn.microsoft.com
8. Microsoft Exchange Team — Support for Exchange Server 2016 and Exchange Server 2019 ends today techcommunity.microsoft.com
9. Microsoft Exchange Team — Announcing Period 2 Exchange 2016/2019 Extended Security Update (ESU) program techcommunity.microsoft.com
10. DIVD — DIVD-2021-00022: Exchange ProxyShell and ProxyOracle csirt.divd.nl