CVE-2021-26855
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV RANSOMWARECRITICAL 9.8EPSS 100.0%
Microsoft Exchange Server Remote Code Execution Vulnerability
- Affected
- Microsoft · Microsoft Exchange Server 2013 Cumulative Update 21 · Microsoft Exchange Server 2013 Cumulative Update 22 · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 10 · Microsoft Exchange Server 2016 Cumulative Update 11 · Microsoft Exchange Server 2016 Cumulative Update 12
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 MICROSOFT
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 100.00% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03, used in ransomware campaigns
- Nuclei
- critical · CWE-918
- Published
- 2021-03-02
- Updated
- 2026-08-19
Proof-of-concept exploits (50)
- http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-W…
- http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Exe…
- http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email…
- http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
- Ahsanzia/Exchange-Exploit5★ · 2021-03-05
- Immersive-Labs-Sec/ProxyLogon3★ · 2021-03-22
- La3B0z/CVE-2021-26855-SSRF-Exchange6★ · 2021-03-06
- MacAsure/cve-2021-268550★ · 2023-04-25
- Mr-xn/CVE-2021-26855-d6★ · 2021-03-15
- Nick-Yin12/1063625220★ · 2021-04-19
- R0XDEADBEEF/CVE-2021-2685512★ · 2024-01-01
- RickGeex/ProxyLogon33★ · 2021-05-01
- ShyTangerine/cve-2021-268550★ · 2023-04-25
- TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit4★ · 2021-03-17
- Th3eCrow/CVE-2021-26855-SSRF-Exchange6★ · 2021-03-06
- WiredPulse/Invoke-HAFNIUMCheck.ps14★ · 2021-03-16
- Yt1g3r/CVE-2021-26855_SSRF4★ · 2021-03-11
- ZephrFish/Exch-CVE-2021-2685528★ · 2026-07-31
- ZephrFish/Exch-CVE-2021-26855_Priv4★ · 2026-07-30
- adarshpv9746/Microsoft-Proxylogon0★ · 2022-11-07
- andyinmatrix/PowerShell1★ · 2024-02-23
- catmandx/CVE-2021-26855-Exchange-RCE0★ · 2021-03-18
- conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-2685536★ · 2021-03-06
- evilashz/ExchangeSSRFtoRCEExploit28★ · 2021-03-15
- glen-pearson/ProxyLogon-CVE-2021-268551★ · 2025-11-11
- h4x0r-dz/CVE-2021-2685598★ · 2021-03-09
- hackerschoice/CVE-2021-2685559★ · 2021-03-11
- hackerxj007/CVE-2021-268555★ · 2021-03-08
- hakivvi/proxylogon22★ · 2022-04-23
- herwonowr/exprolog185★ · 2021-10-19
- hictf/CVE-2021-26855-CVE-2021-270650★ · 2021-03-23
- iceberg-N/cve-2021-268550★ · 2023-04-25
- kh4sh3i/ProxyLogon9★ · 2023-03-28
- mil1200/ProxyLogon-CVE-2021-268559★ · 2021-03-14
- p0wershe11/ProxyLogon124★ · 2021-03-17
- praetorian-inc/proxylogon-exploit52★ · 2021-03-24
- pussycat0x/CVE-2021-26855-SSRF24★ · 2021-03-10
- r0xDB/CVE-2021-2685512★ · 2024-01-01
- raheel0x01/CVE-2021-2685512★ · 2024-01-01
- saucer-man/exploit11★ · 2021-07-09
- srvaccount/CVE-2021-26855-PoC17★ · 2021-03-09
- stressboi/hafnium-exchange-splunk-csvs6★ · 2021-03-03
- thau0x01/poc_proxylogon8★ · 2022-02-10
- timb-machine-mirrors/testanull-CVE-2021-26855_read_poc.txt0★ · 2024-01-04
- KotSec/CVE-2021-26855-Scanner3★ · 2021-03-12
- SimoesCTT/CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-…1★ · 2026-01-28
- SimoesCTT/CTT-ProxyLogon-RCE-v1.0---Convergent-Time-Theory-Enhanced-Microsoft-Exchange-Ex…0★ · 2026-01-27
- alt3kx/CVE-2021-26855_PoC53★ · 2021-03-12
- haotiku/CVE-2021-26855-exploit-Exchange0★ · 2021-04-05
- wysssadda/ExchangeSmash0★ · 2022-06-24
Nuclei templates (1)
Metasploit modules (3)
- rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxylogon…
- rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/exchange_proxylogon_coll…
- rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/exchange_proxylogo…
ExploitDB entries (4)
- https://www.exploit-db.com/exploits/49895
- https://www.exploit-db.com/exploits/49879
- https://www.exploit-db.com/exploits/49663
- https://www.exploit-db.com/exploits/49637
Exploit collections (3)
- exchange-cve-2021-26855-ssrf.ymlchaitin/xray
- Microsoft Exchange SSRF（CVE-2021-26855）.mdtzwlhack/Vulnerability
- CVE-2021-26855.yamlzan8in/afrog
Security advisories
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855