{"vulnerability": "CVE-2021-34470", "sightings": [{"uuid": "c5bd7799-e699-4a77-9c06-6be8713a43ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:18.000000Z"}, {"uuid": "f66956b4-c98d-43f7-b81f-a4d77230ef7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "seen", "source": "MISP/dd5284a0-b7c5-4c34-925b-f447f331c000", "content": "", "creation_timestamp": "2024-11-26T07:06:59.000000Z"}, {"uuid": "36cc3362-6799-4aec-93c8-9e10f12f24ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-34470", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_21/2021", "content": "", "creation_timestamp": "2021-07-15T10:13:10.000000Z"}, {"uuid": "e7c5200b-1c4b-4665-aaaa-94b01cc62249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/196", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA Powrshell script to scan for CVE-2021-34470\nURL\uff1ahttps://github.com/Yang0615777/PocList", "creation_timestamp": "2021-07-30T03:30:12.000000Z"}, {"uuid": "8a4e5965-40f4-4e4c-b628-5600cf6fe636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/193", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aA Powrshell script to scan for CVE-2021-34470\nURL\uff1ahttps://github.com/technion/CVE-2021-34470scanner", "creation_timestamp": "2021-07-29T23:52:19.000000Z"}, {"uuid": "90c79513-77b7-4cbc-b377-19cac1b451cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "seen", "source": "https://t.me/arpsyndicate/2814", "content": "#ExploitObserverAlert\n\nCVE-2021-34470\n\nDESCRIPTION: Exploit Observer has 7 entries in 3 file formats related to CVE-2021-34470. Microsoft Exchange Server Elevation of Privilege Vulnerability\n\nFIRST-EPSS: 0.000460000\nNVD-IS: 5.9\nNVD-ES: 2.1", "creation_timestamp": "2024-01-15T23:03:31.000000Z"}, {"uuid": "b0cd5b37-e50b-43e6-bf2c-0a28d2e31af0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "seen", "source": "https://t.me/cibsecurity/26163", "content": "\u203c CVE-2021-33768 \u203c\n\nMicrosoft Exchange Server Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-34470, CVE-2021-34523.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-14T22:31:53.000000Z"}, {"uuid": "7cbafc08-208f-4fa2-ac6d-3cc26f130dbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3950", "content": "#exploit\nCVE-2021-34470:\nMS Exchange AD Schema Misconfiguration Privilege Escalation (PoC)\nhttps://packetstormsecurity.com/files/163706/Microsoft-Exchange-AD-Schema-Misconfiguration-Privilege-Escalation.html", "creation_timestamp": "2021-07-30T11:33:01.000000Z"}, {"uuid": "19b95bd4-7456-4e69-8c47-40fadbcada44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "seen", "source": "https://t.me/cissp/3931", "content": "Malware analysis\n1. Malicious Content Delivered Through archive.org\ud83d\ude0a\nhttps://isc.sans.edu/forums/diary/Malicious+Content+Delivered+Through+archiveorg/27688\n2. Crimea \"manifesto\" deploys VBA Rat using double attack vectors\nhttps://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors\n\nexploit\nCVE-2021-34470:\nMS Exchange AD Schema Misconfiguration Privilege Escalation (PoC)\ud83d\ude03\nhttps://packetstormsecurity.com/files/163706/Microsoft-Exchange-AD-Schema-Misconfiguration-Privilege-Escalation.html\n\nThreat Research\n1. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group\nhttps://unit42.paloaltonetworks.com/thor-plugx-variant\n2. Vultur RAT malware, with a V for VNC\nhttps://www.threatfabric.com/blogs/vultur-v-for-vnc.html\n\nFinding and Exploiting Unintended Functionality in Main Web App APIs\nhttps://bendtheory.medium.com/finding-and-exploiting-unintended-functionality-in-main-web-app-apis-6eca3ef000af", "creation_timestamp": "2026-09-01T17:00:44.132017Z"}, {"uuid": "15940cf8-fd5d-41bc-8f42-3a641af2fe91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "seen", "source": "https://t.me/cissp/3931", "content": "Malware analysis\n1. Malicious Content Delivered Through archive.org\ud83d\ude0a\nhttps://isc.sans.edu/forums/diary/Malicious+Content+Delivered+Through+archiveorg/27688\n2. Crimea \"manifesto\" deploys VBA Rat using double attack vectors\nhttps://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors\n\nexploit\nCVE-2021-34470:\nMS Exchange AD Schema Misconfiguration Privilege Escalation (PoC)\ud83d\ude03\nhttps://packetstormsecurity.com/files/163706/Microsoft-Exchange-AD-Schema-Misconfiguration-Privilege-Escalation.html\n\nThreat Research\n1. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group\nhttps://unit42.paloaltonetworks.com/thor-plugx-variant\n2. Vultur RAT malware, with a V for VNC\nhttps://www.threatfabric.com/blogs/vultur-v-for-vnc.html\n\nFinding and Exploiting Unintended Functionality in Main Web App APIs\nhttps://bendtheory.medium.com/finding-and-exploiting-unintended-functionality-in-main-web-app-apis-6eca3ef000af", "creation_timestamp": "2026-09-02T01:04:30.778483Z"}, {"uuid": "784765ee-a983-45c0-a2c3-ed67b7a26179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3931", "content": "Malware analysis\n1. Malicious Content Delivered Through archive.org\ud83d\ude0a\nhttps://isc.sans.edu/forums/diary/Malicious+Content+Delivered+Through+archiveorg/27688\n2. Crimea \"manifesto\" deploys VBA Rat using double attack vectors\nhttps://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors\n\nexploit\nCVE-2021-34470:\nMS Exchange AD Schema Misconfiguration Privilege Escalation (PoC)\ud83d\ude03\nhttps://packetstormsecurity.com/files/163706/Microsoft-Exchange-AD-Schema-Misconfiguration-Privilege-Escalation.html\n\nThreat Research\n1. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group\nhttps://unit42.paloaltonetworks.com/thor-plugx-variant\n2. Vultur RAT malware, with a V for VNC\nhttps://www.threatfabric.com/blogs/vultur-v-for-vnc.html\n\nFinding and Exploiting Unintended Functionality in Main Web App APIs\nhttps://bendtheory.medium.com/finding-and-exploiting-unintended-functionality-in-main-web-app-apis-6eca3ef000af", "creation_timestamp": "2026-09-10T23:00:04.712561Z"}, {"uuid": "d839c676-1bd9-4af9-9246-2128a2919c8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34470", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3931", "content": "Malware analysis\n1. Malicious Content Delivered Through archive.org\ud83d\ude0a\nhttps://isc.sans.edu/forums/diary/Malicious+Content+Delivered+Through+archiveorg/27688\n2. Crimea \"manifesto\" deploys VBA Rat using double attack vectors\nhttps://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-deploys-vba-rat-using-double-attack-vectors\n\nexploit\nCVE-2021-34470:\nMS Exchange AD Schema Misconfiguration Privilege Escalation (PoC)\ud83d\ude03\nhttps://packetstormsecurity.com/files/163706/Microsoft-Exchange-AD-Schema-Misconfiguration-Privilege-Escalation.html\n\nThreat Research\n1. THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group\nhttps://unit42.paloaltonetworks.com/thor-plugx-variant\n2. Vultur RAT malware, with a V for VNC\nhttps://www.threatfabric.com/blogs/vultur-v-for-vnc.html\n\nFinding and Exploiting Unintended Functionality in Main Web App APIs\nhttps://bendtheory.medium.com/finding-and-exploiting-unintended-functionality-in-main-web-app-apis-6eca3ef000af", "creation_timestamp": "2026-09-11T00:00:09.288364Z"}]}