CVE-2021-26855criticalunder attackransomwareCWE-918

CVE-2021-26855: critical vulnerability in Microsoft Exchange Server 2013 Cumulative…

Microsoft Exchange Server Remote Code Execution Vulnerability

Published 02 Mar 2021 · Updated 19 Aug 2026

Follow this CVE + Monitor Microsoft Exchange Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 4 threat group(s) use it.

ssvc Actcvss 9.1epss 100%

from disclosure to weapon1 day

Published on NVDMar 2

1st PoC+1d

metasploitMar 2

CISA KEV+246d

Who exploits it — 4

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT41🇨🇳 MITRE ATT&CK

APT / StateMagic Hound🇮🇷 MITRE ATT&CK

APT / StateThreat Group-3390🇨🇳 MITRE ATT&CK

APT / StateToddyCat MITRE ATT&CK

Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A critical vulnerability in Microsoft Exchange Server allows attackers to execute malicious code remotely on affected servers. An attacker can exploit this flaw to gain full control of the email system without needing valid credentials.

Technical detail

This Server-Side Request Forgery (SSRF) vulnerability in Exchange Server's Autodiscover service allows unauthenticated attackers to execute arbitrary code by crafting malicious HTTP requests that bypass authentication controls. The vulnerability permits remote code execution with SYSTEM privileges, affecting all versions of Exchange Server 2013, 2016, and 2019 in default configurations.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

Affected products

public PoCs found — 102

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Microsoft Exchange Server 2013 Cumulative…

In the same product, most dangerous first.

CVE-2021-34473CRITICALMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEV CVE-2021-34523CRITICALMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEV CVE-2022-41082HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEV CVE-2022-41040HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEV CVE-2021-27065HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 99.9%KEV CVE-2021-31207MEDIUMMicrosoft Exchange Server Security Feature Bypass VulnerabilityEPSS 99.8%KEV

References

http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855