CVE-2021-33766

An unauthenticated attacker could steal email traffic from Microsoft Exchange Server via CVE-2021-33766, a vulnerability actively exploited in the wild.

Microsoft Exchange Server contained an information disclosure vulnerability allowing unauthenticated attackers to intercept and steal email traffic. This failure matters to DIB organizations because it exposes sensitive communications, violates data protection requirements, and highlights the risk of relying on unpatched legacy systems. Organizations must ensure all Exchange servers are patched and monitored for exploitation attempts.

Shame score — A critical information disclosure flaw in a widely deployed enterprise product was actively exploited in the wild, causing mass data breaches and demonstrating severe negligence in patch management and threat intelligence.