{"metadata": {"vulnerability": "CVE-2021-31196", "count": 53, "kinds": {"milestone": 6, "sighting": 12, "kev": 11, "other": 24}, "linked_omitted": 0}, "data": [{"timestamp": "2021-04-14T00:00:00Z", "date_only": false, "value": "2021-04-14T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-31196", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-07-13T14:00:00Z", "date_only": false, "value": "2021-07-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-31196", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-07-13T22:00:00Z", "date_only": false, "value": "2021-07-13T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2021-07-13T22:00:00Z", "date_only": false, "value": "2021-07-13T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-07-13T22:00:00Z", "date_only": false, "value": "2021-07-13T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-07-14T17:53:12Z", "date_only": false, "value": "2021-07-14T17:53:12.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-31196", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-07-14T18:15:00Z", "date_only": false, "value": "2021-07-14T18:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5JV9-CFF9-2J3M", "record": "GHSA-5JV9-CFF9-2J3M", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2021-07-14T18:15:09.463Z", "date_only": false, "value": "2021-07-14T18:15:09.463", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-31196", "record": "FKIE_CVE-2021-31196", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-07-14T18:15:09.463Z", "date_only": false, "value": "2021-07-14T18:15:09.463", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2021-31196", "record": "GSD-2021-31196", "field": "namespaces.nvd.nist.gov.cve.published", "linked_record": true}, {"timestamp": "2021-07-15T00:00:00Z", "date_only": false, "value": "2021-07-15T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2021-AVI-522", "record": "CERTFR-2021-AVI-522", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2021-07-15T00:00:00Z", "date_only": true, "value": "2021-07-15", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2021-51484", "record": "CNVD-2021-51484", "field": "submitTime", "linked_record": true}, {"timestamp": "2021-07-15T10:13:10Z", "date_only": false, "value": "2021-07-15T10:13:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_21/2021", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "4e69399c-8669-4407-b7a9-c0a27b8cf41c", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_21/2021"}, {"timestamp": "2021-07-17T00:00:00Z", "date_only": true, "value": "2021-07-17", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2021-51484", "record": "CNVD-2021-51484", "field": "openTime", "linked_record": true}, {"timestamp": "2021-08-08T22:00:00Z", "date_only": false, "value": "2021-08-08T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2021-08-12T22:00:00Z", "date_only": false, "value": "2021-08-12T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2021-08-30T22:00:00Z", "date_only": false, "value": "2021-08-30T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2021-09-22T08:54:20Z", "date_only": false, "value": "2021-09-22T08:54:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/575", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "7061a4b1-1d84-46d7-862b-17f76f46f62d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1a[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyShell] CVE-2021-31195 & CVE-2021-31196 Exploit Chains\nURL\uff1ahttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/GithubRedTeam/575", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-09-22T14:47:17Z", "date_only": false, "value": "2021-09-22T14:47:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacker_trick/207", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "d8a5534e-8476-40b6-8c46-03fd6740babc", "content": "[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [ProxyShell] WaitForUpdate\n\nhttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/hacker_trick/207", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2021-11-08T08:58:18Z", "date_only": false, "value": "2021-11-08T08:58:18.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "0b50611e-74d9-4119-b24f-10484cba24af"}, {"timestamp": "2022-05-24T19:07:57Z", "date_only": false, "value": "2022-05-24T19:07:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5JV9-CFF9-2J3M", "record": "GHSA-5JV9-CFF9-2J3M", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2023-12-13T01:23:13.197Z", "date_only": false, "value": "2023-12-13T01:23:13.197594Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-31196", "record": "GSD-2021-31196", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2023-12-28T23:15:13.237Z", "date_only": false, "value": "2023-12-28T23:15:13.237", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-31196", "record": "GSD-2021-31196", "field": "namespaces.nvd.nist.gov.cve.lastModified", "linked_record": true}, {"timestamp": "2024-08-03T22:55:53.341Z", "date_only": false, "value": "2024-08-03T22:55:53.341Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-31196", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": false, "value": "2024-08-21T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-31196", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b0761058-0071-40eb-b71d-8cfad0debfbb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": false, "value": "2024-08-21T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-31196", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c70262a8-fadb-408b-bfb4-ca12d0a9ae2f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": true, "value": "2024-08-21", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-31196", "field": "containers.adp.1.metrics.0.other.content.dateAdded"}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": false, "value": "2024-08-21T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-31196", "field": "evidence.0.details.added_date", "uuid": "c70262a8-fadb-408b-bfb4-ca12d0a9ae2f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": true, "value": "2024-08-21", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-31196", "field": "evidence.0.details.date_added", "uuid": "b0761058-0071-40eb-b71d-8cfad0debfbb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": false, "value": "2024-08-21T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-31196", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "b0761058-0071-40eb-b71d-8cfad0debfbb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": false, "value": "2024-08-21T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-31196", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "c70262a8-fadb-408b-bfb4-ca12d0a9ae2f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": false, "value": "2024-08-21T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-31196", "field": "status.status_updated_at", "uuid": "b0761058-0071-40eb-b71d-8cfad0debfbb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-21T00:00:00Z", "date_only": false, "value": "2024-08-21T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-31196", "field": "status.status_updated_at", "uuid": "c70262a8-fadb-408b-bfb4-ca12d0a9ae2f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-21T18:10:02Z", "date_only": false, "value": "2024-08-21T18:10:02.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "e53d556d-df91-4bce-934b-66ad17044d48"}, {"timestamp": "2024-08-21T22:00:00Z", "date_only": false, "value": "2024-08-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "document.tracking.revision_history.4.date", "linked_record": true}, {"timestamp": "2024-08-21T22:00:00Z", "date_only": false, "value": "2024-08-21T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2024-08-22T08:13:42.843Z", "date_only": false, "value": "2024-08-22T08:13:42.843+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1897", "record": "WID-SEC-W-2024-1897", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2024-09-11T00:00:00Z", "date_only": true, "value": "2024-09-11", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-31196", "field": "evidence.0.details.due_date", "uuid": "b0761058-0071-40eb-b71d-8cfad0debfbb", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-01-28T16:51:30.730Z", "date_only": false, "value": "2025-01-28T16:51:30.730018Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-31196", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-01-28T16:51:30.730Z", "date_only": false, "value": "2025-01-28T16:51:30.730018Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-31196", "record": "FKIE_CVE-2021-31196", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2025-02-23T02:10:57Z", "date_only": false, "value": "2025-02-23T02:10:57.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "6b32b2fd-ad8e-46a9-a070-a7af000960bd"}, {"timestamp": "2026-01-12T21:08:51.522Z", "date_only": false, "value": "2026-01-12T21:08:51.522Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2021-31196", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-02-02T12:26:30.867Z", "date_only": false, "value": "2026-02-02T12:26:30.867457Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b0761058-0071-40eb-b71d-8cfad0debfbb", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "356dd8ee-83f0-495a-91ac-c8383e654858", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b0761058-0071-40eb-b71d-8cfad0debfbb", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-19T12:46:36.419Z", "date_only": false, "value": "2026-06-19T12:46:36.419727Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/17d42756-31ab-4832-9202-213eabf66db0", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "fd862e6d-a2a1-4f63-9a35-50dfb020665b", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/17d42756-31ab-4832-9202-213eabf66db0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:02:37Z", "date_only": false, "value": "2026-06-23T14:02:37+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-31196", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "c70262a8-fadb-408b-bfb4-ca12d0a9ae2f", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T14:05:57.061Z", "date_only": false, "value": "2026-06-23T14:05:57.061924Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c70262a8-fadb-408b-bfb4-ca12d0a9ae2f", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "14de2521-1bd9-4859-afd0-af91b87c197c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c70262a8-fadb-408b-bfb4-ca12d0a9ae2f", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-12T22:00:13.534Z", "date_only": false, "value": "2026-07-12T22:00:13.534431Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/660", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "21684677-5c19-4370-8e9c-713bb1b83788", "content": "\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31195\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31195\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\nCVSS Score: 8.8 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-31196\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31196\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34473\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 MS Exchange\nCVE-ID: CVE-2021-34523\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523\nCVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 9.8 (Critical)\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MS Exchange\nCVE-ID: CVE-2021-31207\nVENDOR-ADVISORY: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207\nCVSS: 3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\nCVSS Score: 7.2 (High)\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b:\nMicrosoft Exchange Server 2013\nMicrosoft Exchange Server 2016\nMicrosoft Exchange Server 2019", "url": "https://t.me/securixy_kz/660"}, {"timestamp": "2026-07-12T22:00:13.740Z", "date_only": false, "value": "2026-07-12T22:00:13.740838Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/659", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "5c67c3b0-fe6d-443f-ac22-0b464cb4f183", "content": "\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ProxyShell\n\n\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439, \u0438\u043c\u0435\u043d\u0443\u0435\u043c\u0430\u044f \u043a\u0430\u043a LockFile, \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Microsoft Exchange \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u043e\u043c\u0435\u043d\u043e\u0432 Windows \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ProxyShell.\n\nProxyShell - \u044d\u0442\u043e \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 Microsoft Exchange \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0442\u0440\u0451\u0445 (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. Microsoft \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0449\u0451 \u0432 \u043c\u0430\u0435 2021 \u0433\u043e\u0434\u0430, 5 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2021 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 Black Hat USA 2021 \u0431\u044b\u043b \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0434\u043e\u043a\u043b\u0430\u0434 \u043e \u043d\u043e\u0432\u044b\u0445 \u043f\u043b\u043e\u0441\u043a\u043e\u0441\u0442\u044f\u0445 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 MS Exchange \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (CVE-2021-31195, CVE-2021-31196, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u0432\u0442\u043e\u0440\u0443\u044e \u0436\u0438\u0437\u043d\u044c.\n\n\u0412\u0441\u0435\u043c\u0443 \u041a\u0430\u0437\u043d\u0435\u0442\u0443, \u043a\u043e\u043b\u043b\u0435\u0433\u0430\u043c \u0438\u0437 \u0420\u043e\u0441\u0441\u0438\u0438 \u043a\u0440\u0430\u0439\u043d\u0435 \u0441\u043e\u0432\u0435\u0442\u0443\u0435\u043c \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u043b\u0430\u0442\u043a\u0438.", "url": "https://t.me/securixy_kz/659"}, {"timestamp": "2026-08-10T15:10:55.448Z", "date_only": false, "value": "2026-08-10T15:10:55.448Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-31196", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-10T15:10:55.448Z", "date_only": false, "value": "2026-08-10T15:10:55.448Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2021-31196", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-10T17:06:06.004Z", "date_only": false, "value": "2026-08-10T17:06:06.004297Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msqlje7ttb2r", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "1b885dca-62e7-47de-b9a7-9d8628e8f91f", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-31196: Microsoft Exchange Server Remote Code Execution Vulnerability\nCVSS 7.2 \u00b7 EPSS 46.4% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-31196\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3msqlje7ttb2r"}, {"timestamp": "2026-08-10T18:30:29Z", "date_only": false, "value": "2026-08-10T18:30:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5JV9-CFF9-2J3M", "record": "GHSA-5JV9-CFF9-2J3M", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-10T19:58:38.973Z", "date_only": false, "value": "2026-08-10T19:58:38.973", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-31196", "record": "FKIE_CVE-2021-31196", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-04T13:31:51Z", "date_only": false, "value": "2026-11-04T13:31:51+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-31196", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "b0761058-0071-40eb-b71d-8cfad0debfbb", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-15T07:36:08.039Z", "anchors": {"origin": {"timestamp": "2021-07-13T14:00:00Z", "date_only": false, "value": "2021-07-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-31196", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2021-07-13T14:00:00Z", "date_only": false, "value": "2021-07-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-31196", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2021-09-22T08:54:20Z", "date_only": false, "value": "2021-09-22T08:54:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/575", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "7061a4b1-1d84-46d7-862b-17f76f46f62d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1a[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyShell] CVE-2021-31195 & CVE-2021-31196 Exploit Chains\nURL\uff1ahttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/GithubRedTeam/575", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2021-09-22T14:47:17Z", "date_only": false, "value": "2021-09-22T14:47:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacker_trick/207", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "d8a5534e-8476-40b6-8c46-03fd6740babc", "content": "[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [ProxyShell] WaitForUpdate\n\nhttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/hacker_trick/207", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 6137237.0, "hours": 1704.7880555555555, "days": 71.03283564814815, "min_seconds": 6137237.0, "max_seconds": 6137237.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-07-13T14:00:00Z", "date_only": false, "value": "2021-07-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-31196", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-09-22T14:47:17Z", "date_only": false, "value": "2021-09-22T14:47:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacker_trick/207", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "d8a5534e-8476-40b6-8c46-03fd6740babc", "content": "[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [ProxyShell] WaitForUpdate\n\nhttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/hacker_trick/207", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 6137237.0, "hours": 1704.7880555555555, "days": 71.03283564814815, "min_seconds": 6137237.0, "max_seconds": 6137237.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-07-13T14:00:00Z", "date_only": false, "value": "2021-07-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-31196", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-09-22T14:47:17Z", "date_only": false, "value": "2021-09-22T14:47:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacker_trick/207", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "d8a5534e-8476-40b6-8c46-03fd6740babc", "content": "[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [ProxyShell] WaitForUpdate\n\nhttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/hacker_trick/207", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 6116060.0, "hours": 1698.9055555555556, "days": 70.78773148148149, "min_seconds": 6116060.0, "max_seconds": 6116060.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-07-13T14:00:00Z", "date_only": false, "value": "2021-07-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-31196", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-09-22T08:54:20Z", "date_only": false, "value": "2021-09-22T08:54:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/575", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "7061a4b1-1d84-46d7-862b-17f76f46f62d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1a[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyShell] CVE-2021-31195 & CVE-2021-31196 Exploit Chains\nURL\uff1ahttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/GithubRedTeam/575", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 168543368.039953, "hours": 46817.60223332028, "days": 1950.733426388345, "min_seconds": 168543368.039953, "max_seconds": 168543368.039953, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-07-13T14:00:00Z", "date_only": false, "value": "2021-07-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2021-31196", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-15T07:36:08.039Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 162406131.039953, "hours": 45112.81417776472, "days": 1879.7005907401967, "min_seconds": 162406131.039953, "max_seconds": 162406131.039953, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-09-22T14:47:17Z", "date_only": false, "value": "2021-09-22T14:47:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/hacker_trick/207", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "d8a5534e-8476-40b6-8c46-03fd6740babc", "content": "[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [ProxyShell] WaitForUpdate\n\nhttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/hacker_trick/207", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-15T07:36:08.039Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 162427308.039953, "hours": 45118.69667776472, "days": 1879.9456949068633, "min_seconds": 162427308.039953, "max_seconds": 162427308.039953, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-09-22T08:54:20Z", "date_only": false, "value": "2021-09-22T08:54:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/575", "record": "CVE-2021-31196", "field": "creation_timestamp", "uuid": "7061a4b1-1d84-46d7-862b-17f76f46f62d", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1a[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyShell] CVE-2021-31195 & CVE-2021-31196 Exploit Chains\nURL\uff1ahttps://github.com/hosch3n/ProxyVulns", "url": "https://t.me/GithubRedTeam/575", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-15T07:36:08.039Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}