Microsoft Microsoft Exchange Server 2016 Cumulative Update 21

Name: Microsoft Microsoft Exchange Server 2016 Cumulative Update 21
Brand: Microsoft

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

unpatched

by severity

1critical3high12medium0low

updated 2026-10-28

vulnerabilities (16)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-42321US	medium6.5OT critical	91.7% (100th)	KEV	15.01.2308.020	2021-11-10	15.01.0 → 15.01.2308.020
CVE-2021-31196US	medium6.5OT critical	54.1% (99th)	KEV	15.01.2308.014	2021-07-14	15.01.0 → 15.01.2308.014
CVE-2021-41349US	medium4.3	93.5% (100th)	Exploit	15.01.2308.020	2021-11-10	15.01.0 → 15.01.2308.020
CVE-2022-23277US	medium6.5	41.1% (99th)	Exploit	15.01.2308.027	2022-03-09	15.01.0 → 15.01.2308.027
CVE-2021-34470US	medium5.2	4.38% (91st)	Exploit	15.01.2308.008	2021-07-14	15.01.0 → 15.01.2308.008
CVE-2022-24463US	medium4.0	31.8% (98th)	—	15.01.2308.027	2022-03-09	15.01.0 → 15.01.2308.027
CVE-2021-31206US	high7.9	13.0% (96th)	—	15.01.2308.014	2021-07-14	15.01.0 → 15.01.2308.014
CVE-2021-42305US	medium4.3	7.87% (95th)	—	15.01.2308.020	2021-11-10	15.01.0 → 15.01.2308.020
CVE-2021-34453US	medium5.0	2.83% (87th)	—	15.01.2308.015	2021-10-13	15.01.0 → 15.01.2308.015
CVE-2021-41350US	medium4.3	1.91% (80th)	—	15.01.2308.015	2021-10-13	15.01.0 → 15.01.2308.015
CVE-2021-33768US	medium5.2	1.23% (69th)	—	15.01.2308.014	2021-07-14	15.01.0 → 15.01.2308.014
CVE-2022-21969US	critical9.0	1.12% (66th)	—	15.01.2308.021	2022-01-11	15.01.0 → 15.01.2308.021
CVE-2022-21846US	high8.3	1.06% (64th)	—	15.01.2308.021	2022-01-11	15.01.0 → 15.01.2308.021
CVE-2022-21855US	high7.7	0.93% (60th)	—	15.01.2308.021	2022-01-11	15.01.0 → 15.01.2308.021
CVE-2021-26427US	medium5.8	0.89% (59th)	—	15.01.2308.015	2021-10-13	15.01.0 → 15.01.2308.015
CVE-2021-41348US	medium5.2	0.59% (48th)	—	15.01.2308.015	2021-10-13	15.01.0 → 15.01.2308.015

weaknesses (7)

The flaw types (CWEs) most of these CVEs share.

CWE-94Improper Control of Generation of Code ('Code Injection')5 CVEs
CWE-20Improper Input Validation4 CVEs
CWE-269Improper Privilege Management3 CVEs
CWE-264CWE-2642 CVEs
CWE-451User Interface (UI) Misrepresentation of Critical Information2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)16 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan