Also featured on the list are CVE-2021-34473, CVE-2021-31207, and CVE-2021-34523. These vulnerabilities affect Microsoft Exchange email servers. When combined, successful exploitation enables a remote actor to execute arbitrary code. These vulnerabilities are found within the Microsoft Client Access Service (CAS), typically running on port 443 in Microsoft Internet Information Services (IIS), such as Microsoft's web server. CAS is often exposed to the internet to enable users to access their email via mobile devices and web browsers.