Loading vulnerability…
CVE-2021-28482 is a post-authentication remote code execution vulnerability in on-premises Microsoft Exchange Server. The flaw is associated with the OWA Meeting Poll functionality exposed through the MeetingPollHandler endpoint. Available technical analysis indicates that request processing reaches MeetingPollHandler.ProcessRequest(), then MeetingPollProposeOptionsPayload.ProcessRequest(), which in turn invokes EntitySerializer.Deserialize() and ultimately DataContractSerializer.ReadObject() on attacker-controlled data. The vulnerable design appears to stem from unsafe deserialization of Exchange objects derived through SchematizedObject and PropertyChangeTrackingObject, where a PropertyBag-backed Dictionary<string, object> can carry attacker-supplied serialized object content. This permissive deserialization behavior can allow a crafted gadget chain, such as ObjectDataProvider, to be instantiated during deserialization and lead to code execution in the Exchange web application context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Python proof-of-concept exploit script targeting Microsoft Exchange 2016 servers. The script leverages NTLM authentication to interact with the Exchange server's /owa and /ews/Exchange.asmx endpoints. The main exploit vector is a crafted XML payload sent to the /owa/MeetingPollHandler.ashx endpoint, exploiting a deserialization vulnerability to execute arbitrary commands (default: mspaint.exe) on the server. The script also includes logic to clean up after exploitation by deleting the created item via the Exchange Web Services (EWS) API. The code is operational, requiring valid credentials and network access to the target Exchange server. The exploit demonstrates command execution and is not just a detection script. The repository is structured as a single Python file with all logic contained within.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific vulnerability mentioned only as an exploit used or possibly used by BlackTech; no further details are given.
A post-auth remote code execution vulnerability in Microsoft Exchange involving unsafe .NET deserialization via MeetingPollHandler and DataContractSerializer, allowing attacker-controlled gadget chains to execute commands on the Exchange server.
A remote code execution vulnerability affecting Microsoft Exchange Server.
A critical remote code execution vulnerability in Microsoft Exchange Server (on-premises only).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.