Patchfirst
Patchfirst
CVE-2021-26857 KEVRansomwarePublic exploit High · 7.8 EPSS 95.8%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server

Heading is the official description · NVD
Breakdown
86.2 / 100
Exploited
Yes, in CISA KEV
Reports
3
Tactics
1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. What they do

First seen exploited 1 day before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 8 days after disclosure.

  1. First seen exploitedVulnCheck KEV evidence1 day before
  2. Disclosedday 0
  3. Public exploit codePoC-in-GitHub+8 days
  4. Added to CISA KEVknown ransomware use; EU database agrees+8 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

1 , grouped by in kill-chain order, 1 cited passage 1

PersistenceTA0003

Web Shell T1505.003 Medium
MITRE CTID mapping of the KEV entry · primary impact

CVE-2021-26857, part of Proxy Logon, is an insecure deserialization vulnerability in the Unified Messaging service. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could execute arbitrary code as SYSTEM on the Exchange Server. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.

Lower-confidence links (2)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • External Remote ServicesT1133 needs user interaction; not a public-facing exploit
  • Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit

Detection

1 rule for this CVE · 35 general rules for its techniques

Rules for this CVE

1 that reference CVE-2021-26857 directly.

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Web ShellT1505.00335 general rules
All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 3 threat reports
3 reportsCISANCSC UKi.blackhat.com

Reports are matched by finding the exact id CVE-2021-26857 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag

Vendor Advisory 2

msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26857
↑ ↓ chooseEnter openEsc close