{"id":"CVE-2021-26857","published":"2021-03-03T00:15:12Z","modified":"2026-08-19T19:22:27Z","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Exchange Server","tier":"core","eol":null,"description":{"text":"Microsoft Exchange Server Remote Code Execution Vulnerability","provenance":"source","from":"NVD"},"summary":null,"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.95762,"percentile":0.99871,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26857","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-03-02","exploitedFirstSeen":"2021-03-02","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2021/03/02/microsoft-releases-out-band-security-updates-exchange-server","date":"2021-03-02"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2021-03-02"},{"url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers","date":"2021-03-02"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa21-062a","date":"2021-03-03"},{"url":"https://www.crowdstrike.com/blog/falcon-complete-stops-microsoft-exchange-server-zero-day-exploits/","date":"2021-03-04"},{"url":"https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html","date":"2021-03-04"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2021-Mar","date":"2021-03-10"},{"url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/","date":"2021-03-10"},{"url":"https://threatpost.com/microsoft-exchange-servers-apt-attack/164695/","date":"2021-03-11"},{"url":"https://securityscorecard.com/blog/microsoft-exchange-attack-surface-was-smaller-and-more-targeted-than-previously-thought","date":"2021-03-15"}],"evidenceTotal":51,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857","tags":["Patch","Vendor Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26857","tags":["US Government Resource"]}],"techniques":[{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2021-26857, part of Proxy Logon, is an insecure deserialization vulnerability in the Unified Messaging service. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could execute arbitrary code as SYSTEM on the Exchange Server. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-26857, part of Proxy Logon, is an insecure deserialization vulnerability in the Unified Messaging service. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could execute arbitrary code as SYSTEM on the Exchange Server. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.","confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"machine","basis":"report-passage","bases":["report-passage"],"basisDetail":"keyword query KW:T1190:2","mappingType":null,"evidence":[{"reportId":"SRC-ff02b0d97dbe7522c519","quote":"In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.","start":4237,"end":4407}],"confidence":"low","confidenceNote":"needs user interaction; not a public-facing exploit"}],"reports":[{"id":"SRC-ff02b0d97dbe7522c519","title":"Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization","publisher":"cisa.gov","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a","date":null,"mentions":[{"quote":"In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.","start":4237,"end":4407}]},{"id":"SRC-8b6e5f3c2592261e3f88","title":"Advisory further TTPs associated with SVR cyber actors","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf","date":null,"mentions":[{"quote":"• CVE-2021-26857 (SOAP payload)","start":3669,"end":3700}]},{"id":"SRC-14820bfbde5abb2b0561","title":"Us 21 Anatomy Of Native Iis Malware wp","publisher":"i.blackhat.com","url":"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf","date":null,"mentions":[{"quote":"pre-authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-","start":9313,"end":9413},{"quote":"ProxyLogon vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-","start":20128,"end":20221},{"quote":"authentication RCE vulnerability chain (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-","start":22404,"end":22500}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-13641","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-13641","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2021-03-11","earliestUrl":"https://github.com/sirpedrotavares/Proxylogon-exploit","repos":[{"name":"sirpedrotavares/Proxylogon-exploit","url":"https://github.com/sirpedrotavares/Proxylogon-exploit","stars":111,"created":"2021-03-11"}]},"first":{"date":"2021-03-11","source":"PoC-in-GitHub","url":"https://github.com/sirpedrotavares/Proxylogon-exploit"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential CVE-2021-26857 Exploitation Attempt","id":"cd479ccc-d8f0-4c66-ba7d-e06286f3f887","level":"high","status":"stable","path":"rules-emerging-threats/2021/Exploits/CVE-2021-26857/proc_creation_win_exploit_cve_2021_26857_msexchange.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26857/proc_creation_win_exploit_cve_2021_26857_msexchange.yml","techniques":["T1203"]}]},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1505.003"],"provenance":"source"},{"stage":"related","techniques":["T1133"],"provenance":"source","lowConfidence":true},{"stage":"observed","techniques":["T1190"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2021-03-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2021/03/02/microsoft-releases-out-band-security-updates-exchange-server","provenance":"source"},{"date":"2021-03-03","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26857","provenance":"source"},{"date":"2021-03-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sirpedrotavares/Proxylogon-exploit","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-13641","provenance":"source"}],"speed":{"daysToPublicExploit":8,"firstExploitFrom":"PoC-in-GitHub","daysToKev":245},"priority":{"score":86.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2069 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-exchange-server-cwe-502"}}