Patchfirst
Patchfirst
CVE-2021-27065 KEVRansomwarePublic exploit High · 7.8 EPSS 99.9%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server

Heading is the official description · NVD
Breakdown
87.4 / 100
Exploited
Yes, in CISA KEV
Reports
4
Tactics
1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. What they do

First seen exploited 1 day before it was disclosed. Public exploit code (Metasploit) was available 1 day before disclosure.

  1. First seen exploitedVulnCheck KEV evidencePublic exploit codeMetasploit1 day before
  2. Disclosedday 0
  3. Added to CISA KEVknown ransomware use; EU database agrees+8 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

1 , grouped by in kill-chain order, 1 cited passage 1

PersistenceTA0003

Web Shell T1505.003 Medium
MITRE CTID mapping of the KEV entry · primary impact

CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server.

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit

Detection

0 rules for this CVE · 35 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-27065 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Web ShellT1505.00335 general rules
All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 4 threat reports
4 reportsCISASymanteci.blackhat.com+1

Reports are matched by finding the exact id CVE-2021-27065 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

5 links, grouped by NVD tag

Vendor Advisory 2

msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27065

Third Party Advisory 2

packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.htmlpacketstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
↑ ↓ chooseEnter openEsc close