An information disclosure vulnerability (CVE-2021-33766) in Microsoft Exchange Server could allow an unauthenticated attacker to access and steal emails from a target’s mailbox.

If exploited, could reveal victims’ personal information, sensitive company data and more.

With this vulnerability, an unauthenticated attacker can perform configuration actions on mailboxes belonging to arbitrary users.

                                                                     Table 1: Vulnerability details  

                                                                        Table 2: Vulnerable versions