CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange ServerApplications & CMS

CVSS

9.1Critical

ExploitationExploited in the wildAdded to KEV 3 Nov 2021. Known ransomware useCISA KEV

Exploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in15.00.1395.012Also 15.00.1473.006, 15.00.1497.012 and 21 moreCVE List

Federal deadline3 May 2022Remediation due date for US federal agenciesCISA KEV

CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

15.00.1395.012Microsoft Exchange Server 2013 Cumulative Update 21CVE List
15.00.1473.006Microsoft Exchange Server 2013 Cumulative Update 22CVE List
15.00.1497.012Microsoft Exchange Server 2013 Cumulative Update 23CVE List
15.01.1531.012Microsoft Exchange Server 2016 Cumulative Update 10CVE List
15.01.1591.018Microsoft Exchange Server 2016 Cumulative Update 11CVE List
15.01.1713.010Microsoft Exchange Server 2016 Cumulative Update 12CVE List

Show all 24 fixed versions

15.01.1779.008Microsoft Exchange Server 2016 Cumulative Update 13CVE List
15.01.1847.012Microsoft Exchange Server 2016 Cumulative Update 14CVE List
15.01.1913.012Microsoft Exchange Server 2016 Cumulative Update 15CVE List
15.01.1979.008Microsoft Exchange Server 2016 Cumulative Update 16CVE List
15.01.2044.013Microsoft Exchange Server 2016 Cumulative Update 17CVE List
15.01.2106.013Microsoft Exchange Server 2016 Cumulative Update 18CVE List
15.01.2176.009Microsoft Exchange Server 2016 Cumulative Update 19CVE List
15.01.1415.010Microsoft Exchange Server 2016 Cumulative Update 8CVE List
15.01.1466.016Microsoft Exchange Server 2016 Cumulative Update 9CVE List
15.02.0221.018Microsoft Exchange Server 2019CVE List
15.01.1979.006Microsoft Exchange Server 2019 Cumulative Update 1CVE List
15.02.0397.011Microsoft Exchange Server 2019 Cumulative Update 2CVE List
15.02.0464.015Microsoft Exchange Server 2019 Cumulative Update 3CVE List
15.02.0659.012Microsoft Exchange Server 2019 Cumulative Update 4CVE List
15.02.0595.008Microsoft Exchange Server 2019 Cumulative Update 5CVE List
15.02.0529.013Microsoft Exchange Server 2019 Cumulative Update 6CVE List
15.02.0721.013Microsoft Exchange Server 2019 Cumulative Update 7CVE List
15.02.0792.010Microsoft Exchange Server 2019 Cumulative Update 8CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

2 Mar 2021Exploit code publicMetasploit
2 Mar 2021, 23:55 UTCPublishedCVE List
3 Nov 2021Added to CISA KEVCISA KEV

Public exploit code and templates 8

Auxiliary moduleMicrosoft Exchange ProxyLogon Collector 2 Mar 2021Metasploit
Exploit moduleMicrosoft Exchange ProxyLogon RCE 2 Mar 2021Metasploit
Auxiliary moduleMicrosoft Exchange ProxyLogon Scanner 2 Mar 2021Metasploit
Remote exploitMicrosoft Exchange 2019 - Server-Side Request Forgery 14 Mar 2021Exploit-DB
Webapps exploitMicrosoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC) 11 Mar 2021Exploit-DB
Webapps exploitMicrosoft Exchange 2019 - Unauthenticated Email Download 18 May 2021Exploit-DB
Webapps exploitMicrosoft Exchange 2019 - Unauthenticated Email Download (Metasploit) 21 May 2021Exploit-DB
Scanner templateMicrosoft Exchange Server SSRF VulnerabilityNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Text from CVE List

Affected versions 24