---
title: "Exchange CVE-2021-31196: ProxyOracle Padding Oracle in KEV"
url: https://erroneo.us/security/briefs/exchange-cve-2021-31196-proxyoracle-padding-oracle/
description: "A July 2021 Exchange padding-oracle bug (ProxyOracle) that can expose OWA passwords joined CISA KEV in 2024. Any server this old needs replacing, not a patch."
type: security-brief
section: "Security Digest"
date_published: 2021-07-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2021-31196"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Exchange CVE-2021-31196: ProxyOracle Padding Oracle in KEV

**Verdict: Check exposure.** Fixed in July 2021 and flagged as exploited only in 2024; the real question is whether any Exchange server that old still runs, because one that does has far bigger problems than this bug.

- **Who must act:** Anyone with an on-premises Exchange 2013, 2016 or 2019 server still on a build older than the July 2021 Security Update, especially with Outlook Web Access reachable from the internet.
- **Who can relax:** Exchange Online-only tenants and on-premises shops running Exchange Server Subscription Edition with current Security Updates are not exposed to this bug.
- **Affected:** Exchange Server 2013 CU23 before 15.00.1497.023; Exchange Server 2016 CU20 before 15.01.2242.012; Exchange Server 2016 CU21 before 15.01.2308.014; Exchange Server 2019 CU9 before 15.02.0858.015; Exchange Server 2019 CU10 before 15.02.0922.013; Earlier cumulative updates, for which Microsoft listed no fix
- **Fixed:** July 13, 2021 Security Updates KB5004778 (2013 CU23), KB5004779 (2016 CU20/CU21) and KB5004780 (2019 CU9/CU10); Long term: Exchange Server Subscription Edition with current Security Updates, or Exchange Online
- **CVEs:** CVE-2021-31196
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Record the exact build of every on-premises Exchange server with the Health Checker script or Exsetup.exe, not just the CU.
2. Take any server older than the July 2021 Security Update off the internet now and treat it as possibly compromised.
3. Migrate remaining Exchange 2013, 2016 and 2019 servers to Exchange Server SE or Exchange Online; none of them receive updates any more.
4. Reset passwords for users who signed in to OWA on a vulnerable server, since ProxyOracle recovers plaintext passwords.
5. Publish OWA only through a VPN, a pre-authenticating reverse proxy or an IP allowlist where you can.

### How to check if you are affected

- Search IIS logs for requests to /owa/auth/frowny.aspx with script in parameters such as app or refurl, the cross-site scripting half (CVE-2021-31195) of the chain.
- Look for bursts of hundreds of OWA requests from one source that all end in 302 redirects, which fits a padding-oracle run.
- Check affected users' later sign-ins for unfamiliar locations or devices.
- On any server that ran pre-July-2021 builds, hunt for web shells in the OWA and ECP folders and for unknown administrator accounts.

## What happened

On July 13, 2021, Microsoft patched CVE-2021-31196 in Exchange Server 2013, 2016 and 2019. The [update guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196) titles it a remote code execution bug, rates it Important with CVSS 3.1 7.2, and listed it as not exploited at release. Microsoft credits Orange Tsai of DEVCORE as the finder.

Tsai's [ProxyOracle write-up](https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-2-ProxyOracle/) explains the bug. Outlook Web Access (OWA) forms-based authentication stores the user's name and password in encrypted `cadata` cookies. CVE-2021-31196 is a padding oracle in how Exchange parses them. The login redirect carries `reason=0` when the padding is invalid and `reason=2` when the cookie decrypts to bad credentials. That difference lets an attacker decrypt any user's cookie. Paired with a reflected cross-site scripting bug, CVE-2021-31195 (patched in May 2021), that steals the cookie, the chain "allows an attacker to recover the user's password in plaintext format completely." The victim only has to open a malicious link.

Three years later, on August 21, 2024, CISA [added](https://www.cisa.gov/news-events/alerts/2024/08/21/cisa-adds-four-known-exploited-vulnerabilities-catalog) the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31196) "based on evidence of active exploitation," with a September 11, 2024 deadline. CISA calls it an information disclosure flaw, which matches the password-recovery impact better than Microsoft's title.

## Who is affected

Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2021-31196) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-31196): Exchange 2013 CU23 before build 15.00.1497.023, Exchange 2016 CU20 before 15.01.2242.012 and CU21 before 15.01.2308.014, and Exchange 2019 CU9 before 15.02.0858.015 and CU10 before 15.02.0922.013. The fixes were KB5004778, KB5004779 and KB5004780. Exchange Online is not listed.

Support status now matters more than the patch. Exchange 2013 left extended support in April 2023, per its [lifecycle page](https://learn.microsoft.com/en-us/lifecycle/products/exchange-server-2013). Exchange 2016 and 2019 reached [end of support on October 14, 2025](https://techcommunity.microsoft.com/blog/exchange/support-for-exchange-server-2016-and-exchange-server-2019-ends-today/4461192). Paid Extended Security Updates kept them patched through 2026, but Microsoft says its [October 13, 2026 release was the last](https://techcommunity.microsoft.com/blog/exchange/announcing-period-2-exchange-20162019-extended-security-update-esu-program/4511603). Only Exchange Server Subscription Edition (SE) still gets fixes.

## Do you really need to act?

Only if you still run an Exchange server this old, and then yes, for reasons wider than this bug. CISA did not say who exploited it or why it was listed in 2024. We found no public threat-intelligence report tying CVE-2021-31196 to a campaign as of October 23, 2026.

The Dutch DIVD [case file](https://csirt.divd.nl/cases/DIVD-2021-00022) tracked ProxyOracle with ProxyShell. It lists CVE-2021-34523 and CVE-2021-31207 as patched and documented the same day as this bug. A server that missed the July 2021 update therefore also lacks those fixes, plus every exploited Exchange fix since, including CVE-2023-21529 and CVE-2026-42897. On such a server, a stolen OWA password is the smallest risk. If you run only Exchange Online, or Exchange SE with current updates, you are not exposed.

## What to do now

1. Find exact builds. Run the Exchange Health Checker (`.\HealthChecker.ps1`) or `Get-Command Exsetup.exe | ForEach-Object {$_.FileVersionInfo}` on each server. `Get-ExchangeServer` shows the CU only, not Security Updates.
2. Take any server below the July 2021 builds off the internet now. Plan a rebuild and investigation, not a patch.
3. Move remaining Exchange 2013, 2016 and 2019 servers to Exchange SE or Exchange Online.
4. Reset passwords for users who signed in to OWA on a vulnerable server.
5. Where you can, publish OWA only through a VPN, a pre-authenticating reverse proxy or an IP allowlist.

## How to tell if you were hit

ProxyOracle leaves thin traces. In IIS logs, look for requests to `/owa/auth/frowny.aspx` with script in parameters such as `app` or `refurl`, the XSS half Tsai documented. Also look for bursts of hundreds of OWA requests from one address that all end in 302 redirects, which fits a padding-oracle run. Then check affected users' later sign-ins for unfamiliar locations. Because a server this old also missed the July 2021 ProxyShell fixes, hunt for web shells in the OWA and ECP directories and for administrator accounts nobody created.

## Timeline

- May 11, 2021 — Microsoft patches CVE-2021-31195, the XSS half of ProxyOracle.
- Jul 13, 2021 — Microsoft patches CVE-2021-31196.
- Aug 6, 2021 — Orange Tsai publishes the ProxyOracle write-up.
- Apr 2023 — Exchange 2013 reaches end of extended support.
- Aug 21, 2024 — CISA adds the CVE to KEV.
- Sep 11, 2024 — Federal remediation deadline.
- Oct 14, 2025 — Exchange 2016 and 2019 reach end of support.
- Oct 13, 2026 — Final Extended Security Update for Exchange 2016 and 2019.

## Sources

1. [Microsoft MSRC — CVE-2021-31196 Microsoft Exchange Server Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196)
2. [CVE record — CVE-2021-31196](https://www.cve.org/CVERecord?id=CVE-2021-31196)
3. [NVD — CVE-2021-31196](https://nvd.nist.gov/vuln/detail/CVE-2021-31196)
4. [DEVCORE (Orange Tsai) — A New Attack Surface on MS Exchange Part 2: ProxyOracle!](https://devco.re/blog/2021/08/06/a-new-attack-surface-on-MS-exchange-part-2-ProxyOracle/)
5. [CISA — Known Exploited Vulnerabilities: CVE-2021-31196](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31196)
6. [CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Aug 21, 2024)](https://www.cisa.gov/news-events/alerts/2024/08/21/cisa-adds-four-known-exploited-vulnerabilities-catalog)
7. [Microsoft Learn — Exchange Server 2013 lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/exchange-server-2013)
8. [Microsoft Exchange Team — Support for Exchange Server 2016 and Exchange Server 2019 ends today](https://techcommunity.microsoft.com/blog/exchange/support-for-exchange-server-2016-and-exchange-server-2019-ends-today/4461192)
9. [Microsoft Exchange Team — Announcing Period 2 Exchange 2016/2019 Extended Security Update (ESU) program](https://techcommunity.microsoft.com/blog/exchange/announcing-period-2-exchange-20162019-extended-security-update-esu-program/4511603)
10. [DIVD — DIVD-2021-00022: Exchange ProxyShell and ProxyOracle](https://csirt.divd.nl/cases/DIVD-2021-00022)

---
Source page: https://erroneo.us/security/briefs/exchange-cve-2021-31196-proxyoracle-padding-oracle/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt