{"id":"CVE-2021-26855","published":"2021-03-03T00:15:12Z","modified":"2026-08-19T19:22:24Z","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Exchange Server","tier":"core","eol":null,"description":{"text":"Microsoft Exchange Server Remote Code Execution Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"Microsoft Exchange Server contains a remote code execution vulnerability classified as server-side request forgery (CWE), which affects the server component that handles requests. An unauthenticated attacker with network access can exploit it with low complexity and no user interaction to achieve high impact on confidentiality and integrity, without needing any prior credentials or configuration changes.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:09Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99996,"percentile":0.99988,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26855","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-03-02","exploitedFirstSeen":"2021-03-02","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2021/03/02/microsoft-releases-out-band-security-updates-exchange-server","date":"2021-03-02"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2021-03-02"},{"url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers","date":"2021-03-02"},{"url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/","date":"2021-03-02"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa21-062a","date":"2021-03-03"},{"url":"https://www.crowdstrike.com/blog/falcon-complete-stops-microsoft-exchange-server-zero-day-exploits/","date":"2021-03-04"},{"url":"https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html","date":"2021-03-04"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2021-Mar","date":"2021-03-10"},{"url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/","date":"2021-03-10"},{"url":"https://threatpost.com/microsoft-exchange-servers-apt-attack/164695/","date":"2021-03-11"}],"evidenceTotal":1155,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2021-26855 allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2021-26855 allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-26855, also known as ProxyLogon, allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-26855, also known as ProxyLogon, allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"machine","basis":"report-passage","bases":["report-passage"],"basisDetail":"keyword query KW:T1190:2","mappingType":null,"evidence":[{"reportId":"SRC-ff02b0d97dbe7522c519","quote":"In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.","start":4237,"end":4407}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-bb30b37395e1aeb15f8a","title":"Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities","publisher":"volexity.com","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/","date":"2021-03-02","mentions":[{"quote":"[UPDATE] March 8, 2021 – Since original publication of this blog, Volexity has now observed that cyber espionage operations using the SSRF vulnerability CVE-2021-26855 started occurring on January 3, 2021, three days earlier than initially posted.","start":230,"end":477},{"quote":"Through its analysis of system memory, Volexity determined the attacker was exploiting a zero-day server-side request forgery (SSRF) vulnerability in Microsoft Exchange (CVE-2021-26855).","start":1651,"end":1837}]},{"id":"SRC-ff02b0d97dbe7522c519","title":"Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a","date":null,"mentions":[{"quote":"In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.","start":4237,"end":4407}]},{"id":"SRC-8b6e5f3c2592261e3f88","title":"Advisory further TTPs associated with SVR cyber actors","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf","date":null,"mentions":[{"quote":"vulnerable to CVE-2021-26855.","start":3425,"end":3454},{"quote":"Exchange servers vulnerable to CVE-2021-\r\n26855.","start":9147,"end":9195}]},{"id":"SRC-5a1fc38d97e601a01ee4","title":"Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool","publisher":"security.com","url":"https://www.security.com:443/threat-intelligence/blackbyte-exbyte-ransomware","date":null,"mentions":[{"quote":"In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.","start":2846,"end":3112}]},{"id":"SRC-14820bfbde5abb2b0561","title":"Us 21 Anatomy Of Native Iis Malware wp","publisher":"i.blackhat.com","url":"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf","date":null,"mentions":[{"quote":"pre-authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-","start":9313,"end":9413},{"quote":"ProxyLogon vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-","start":20128,"end":20221},{"quote":"authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-","start":22404,"end":22500},{"quote":"C:\\ProxyLogon-CVE-2021-26855-main\\IIS-Raid-modify\\module\\x64\\Release\\IIS-","start":23226,"end":23299}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-13639","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-13639","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":49637,"url":"https://www.exploit-db.com/exploits/49637","title":"Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC)","type":"webapps","platform":"windows","date":"2021-03-11","verified":false,"provenance":"source"},{"id":49663,"url":"https://www.exploit-db.com/exploits/49663","title":"Microsoft Exchange 2019 - Server-Side Request Forgery","type":"remote","platform":"windows","date":"2021-03-14","verified":false,"provenance":"source"},{"id":49879,"url":"https://www.exploit-db.com/exploits/49879","title":"Microsoft Exchange 2019 - Unauthenticated Email Download","type":"webapps","platform":"windows","date":"2021-05-18","verified":false,"provenance":"source"},{"id":49895,"url":"https://www.exploit-db.com/exploits/49895","title":"Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)","type":"webapps","platform":"windows","date":"2021-05-21","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2021-03-11"},"pocGithub":{"count":49,"skipped":4,"earliest":"2021-03-03","earliestUrl":"https://github.com/sgnls/exchange-0days-202103","repos":[{"name":"Flangvik/SharpProxyLogon","url":"https://github.com/Flangvik/SharpProxyLogon","stars":247,"created":"2021-03-29"},{"name":"hosch3n/ProxyVulns","url":"https://github.com/hosch3n/ProxyVulns","stars":176,"created":"2021-04-14"},{"name":"dwisiswant0/proxylogscan","url":"https://github.com/dwisiswant0/proxylogscan","stars":166,"created":"2021-03-08"},{"name":"p0wershe11/ProxyLogon","url":"https://github.com/p0wershe11/ProxyLogon","stars":123,"created":"2021-03-17"},{"name":"cert-lv/exchange_webshell_detection","url":"https://github.com/cert-lv/exchange_webshell_detection","stars":98,"created":"2021-03-05"}]},"metasploit":[{"name":"Microsoft Exchange ProxyLogon Collector","module":"auxiliary/gather/exchange_proxylogon_collector","type":"auxiliary","disclosureDate":"2021-03-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/exchange_proxylogon_collector.rb"},{"name":"Microsoft Exchange ProxyLogon Scanner","module":"auxiliary/scanner/http/exchange_proxylogon","type":"auxiliary","disclosureDate":"2021-03-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/exchange_proxylogon.rb"},{"name":"Microsoft Exchange ProxyLogon RCE","module":"exploit/windows/http/exchange_proxylogon_rce","type":"exploit","disclosureDate":"2021-03-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxylogon_rce.rb"}],"nuclei":[{"id":"CVE-2021-26855","name":"Microsoft Exchange Server SSRF Vulnerability","severity":"critical","path":"http/cves/2021/CVE-2021-26855.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26855.yaml"}],"first":{"date":"2021-03-02","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/exchange_proxylogon_collector.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html","http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html","http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html","http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1090"],"provenance":"source"},{"stage":"secondary","techniques":["T1505.003","T1005"],"provenance":"source"},{"stage":"observed","techniques":["T1190"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2021-03-02","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-03-03, Exploit-DB 2021-03-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/exchange_proxylogon_collector.rb","provenance":"source"},{"date":"2021-03-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2021/03/02/microsoft-releases-out-band-security-updates-exchange-server","provenance":"source"},{"date":"2021-03-02","kind":"report","label":"Named in volexity.com: Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnera…","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/","provenance":"machine"},{"date":"2021-03-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26855","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-13639","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":245},"priority":{"score":89.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2069 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":10.0,"detail":"5 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 4 Exploit-DB entries; 49 PoC-in-GitHub repos; 3 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-exchange-server-cwe-918"}}