CVE-2021-26855 KEVRansomwarePublic exploit Critical · 9.1 EPSS >99.9%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server

Summary

Microsoft Exchange Server contains a remote code execution vulnerability classified as server-side request forgery (CWE), which affects the server component that handles requests. An unauthenticated attacker with network access can exploit it with low complexity and no user interaction to achieve high impact on confidentiality and integrity, without needing any prior credentials or configuration changes.

Heading is the official description · NVD

Breakdown

89.4 / 100

Exploited: Yes, in CISA KEV
Reports: 5
Tactics: 4/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Get in through VPN or remote-access servicesT1133 · External Remote ServicesSource dataMedium confidence20 general detection rules
What they do
- Route traffic through a proxyT1090 · ProxySource dataMedium confidence22 general detection rules
What can follow
- Plant a web shell for remote controlT1505.003 · Web ShellSource dataMedium confidence35 general detection rules
- Read files and data on the systemT1005 · Data from Local SystemSource dataMedium confidence14 general detection rules

First seen exploited 1 day before it was disclosed. Public exploit code (Metasploit) was available 1 day before disclosure.

First seen exploitedVulnCheck KEV evidencePublic exploit codeMetasploitNamed in a threat reportvolexity.com2 Mar 20211 day before
Disclosed3 Mar 2021day 0
Added to CISA KEVknown ransomware use; EU database agrees3 Nov 2021+8 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

4 , grouped by in kill-chain order, 1 cited passage 4

Initial AccessTA0001

External Remote Services T1133 Medium also Persistence

MITRE CTID mapping of the KEV entry · how it is exploited

CVE-2021-26855 allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.

PersistenceTA0003

Web Shell T1505.003 Medium

MITRE CTID mapping of the KEV entry · follow-on activity

CVE-2021-26855, also known as ProxyLogon, allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange Server. The vulnerability exploits the Exchange Control Panel (ECP) via a Server-Side Request Forgery (SSRF). This would also allow the attacker to gain access to mailboxes and read sensitive information.

CollectionTA0009

Data from Local System T1005 Medium

MITRE CTID mapping of the KEV entry · follow-on activity

Command and ControlTA0011

Proxy T1090 Medium

MITRE CTID mapping of the KEV entry · primary impact

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploit Public-Facing ApplicationT1190 machine-matched from report text

Detection

0 rules for this CVE · 91 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-26855 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

External Remote ServicesT113320 general rules

External Remote SMB Logon from Public IPhightest
OpenCanary - SSH Login Attempthightest
OpenCanary - SSH New Connection Attempthightest
OpenCanary - Telnet Login Attempthightest
Running Chrome VPN Extensions via the Registry 2 VPN Extensionhightest
Unusual Child Process of dns.exehightest
Unusual File Deletion by Dns.exehightest
Unusual File Modification by dns.exehightest

All 20 on SigmaHQ ↗

ProxyT109022 general rules

Communication To LocaltoNet Tunneling Service Initiatedhightest
Communication To LocaltoNet Tunneling Service Initiated - Linuxhightest
Communication To Ngrok Tunneling Service - Linuxhightest
Communication To Ngrok Tunneling Service Initiatedhightest
HackTool - Htran/NATBypass Executionhightest
Malicious IP Address Sign-In Failure Ratehightest
Malicious IP Address Sign-In Suspicioushightest
Ngrok Usage with Remote Desktop Servicehightest

All 22 on SigmaHQ ↗

Web ShellT1505.00335 general rules

Certificate Request Export to Exchange Webservercriticaltest
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
Mailbox Export to Exchange Webservercriticaltest
Oracle WebLogic Exploitcriticaltest
Solarwinds SUPERNOVA Webshell Accesscriticaltest
Webshell Remote Command Executioncriticaltest
WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
Antivirus - Web Shell Detection Signaturehightest

All 35 on SigmaHQ ↗

Data from Local SystemT100514 general rules

OpenCanary - SMB File Open Requesthightest
Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest
SQLite Chromium Profile Data DB Accesshightest
SQLite Firefox Profile Data DB Accesshightest
VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest
Script Interpreter Spawning Credential Scanner - Linuxhighexperimental
Script Interpreter Spawning Credential Scanner - Windowshighexperimental
Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental

All 14 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 5 threat reports

5 reportsVolexityCISASymantec+2Mar 2021 · 4 undated

Reports are matched by finding the exact id CVE-2021-26855 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Volexity2 Mar 2021

Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

[UPDATE] March 8, 2021 – Since original publication of this blog, Volexity has now observed that cyber espionage operations using the SSRF vulnerability CVE-2021-26855 started occurring on January 3, 2021, three days earlier than initially posted.

2 passages name itOriginal (opens in a new tab) ↗

CISAUndated

Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization

In early March 2021, APT actors exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to install 17 China Chopper webshells on the Exchange Server.

Original (opens in a new tab) ↗

SymantecUndated

Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool

In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.

Original (opens in a new tab) ↗

i.blackhat.comUndated

Us 21 Anatomy Of Native Iis Malware wp

C:\ProxyLogon-CVE-2021-26855-main\IIS-Raid-modify\module\x64\Release\IIS-…

2 passages name itOriginal (opens in a new tab) ↗

Show all 5 reportsShow fewer

NCSC UKUndated

Advisory further TTPs associated with SVR cyber actors

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

7 links, grouped by NVD tag

Exploitation evidence

Exploited in the wild

Listed since 3 Nov 2021. Federal due date 3 May 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 3 Nov 2021. EUVD-2021-13639

Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC)EDB-49637 · webapps · windows · 2021-03-11
Microsoft Exchange 2019 - Server-Side Request ForgeryEDB-49663 · remote · windows · 2021-03-14
Microsoft Exchange 2019 - Unauthenticated Email DownloadEDB-49879 · webapps · windows · 2021-05-18
Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)EDB-49895 · webapps · windows · 2021-05-21

, 30 Oct 2026

>99.9%Top 0.01%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.99%).

3.1

9.1Critical · 9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2069 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9999 20.0/20

Threat reports5 reports 10.0/10

Public exploit code4 NVD references tagged Exploit; 4 Exploit-DB entries; 49 PoC-in-GitHub repos; 3 Metasploit modules; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.1 6.4/7

End-of-life productsupported or unknown 0.0

Total89.4

Record

Published: 3 Mar 2021
Modified: 19 Aug 2026
: CWE-918 Server-Side Request Forgery
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

3What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

PersistenceTA0003

CollectionTA0009

Command and ControlTA0011

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization

Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool

Us 21 Anatomy Of Native Iis Malware wp

Advisory further TTPs associated with SVR cyber actors

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 2

US Government Resource 1

Third Party Advisory 4

How attackers get in

What they do

What can follow

techniques