CVE-2021-26855
KEV RANSOMWARECRITICAL 9.8EPSS 100.0%
Microsoft Exchange Server Remote Code Execution Vulnerability
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS v2.0
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 100.00% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03, used in ransomware campaigns
- Nuclei
- critical · CWE-918
- Published
- 2021-03-02
- Updated
- 2026-08-19
Proof-of-concept exploits (52)
- http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-W…
- http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Exe…
- http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email…
- http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
- 1342486672/Flangvik0★ · 2022-06-07
- Ahsanzia/Exchange-Exploit5★ · 2021-03-05
- Immersive-Labs-Sec/ProxyLogon3★ · 2021-03-22
- La3B0z/CVE-2021-26855-SSRF-Exchange6★ · 2021-03-06
- MacAsure/cve-2021-268550★ · 2023-04-25
- Mr-xn/CVE-2021-26855-d6★ · 2021-03-15
- Nick-Yin12/1063625220★ · 2021-04-19
- R0XDEADBEEF/CVE-2021-2685512★ · 2024-01-01
- RickGeex/ProxyLogon33★ · 2021-05-01
- ShyTangerine/cve-2021-268550★ · 2023-04-25
- TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit4★ · 2021-03-17
- Th3eCrow/CVE-2021-26855-SSRF-Exchange6★ · 2021-03-06
- WiredPulse/Invoke-HAFNIUMCheck.ps14★ · 2021-03-16
- Yt1g3r/CVE-2021-26855_SSRF4★ · 2021-03-11
- ZephrFish/Exch-CVE-2021-2685530★ · 2026-07-31
- ZephrFish/Exch-CVE-2021-26855_Priv4★ · 2026-07-30
- adarshpv9746/Microsoft-Proxylogon0★ · 2022-11-07
- andyinmatrix/PowerShell1★ · 2024-02-23
- catmandx/CVE-2021-26855-Exchange-RCE0★ · 2021-03-18
- conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-2685535★ · 2021-03-06
- evilashz/ExchangeSSRFtoRCEExploit28★ · 2021-03-15
- glen-pearson/ProxyLogon-CVE-2021-268551★ · 2025-11-11
- h4x0r-dz/CVE-2021-2685598★ · 2021-03-09
- hackerschoice/CVE-2021-2685560★ · 2021-03-11
- hackerxj007/CVE-2021-268555★ · 2021-03-08
- hakivvi/proxylogon22★ · 2022-04-23
- herwonowr/exprolog186★ · 2021-10-19
- hictf/CVE-2021-26855-CVE-2021-270650★ · 2021-03-23
- iceberg-N/cve-2021-268550★ · 2023-04-25
- kh4sh3i/ProxyLogon9★ · 2023-03-28
- mil1200/ProxyLogon-CVE-2021-268559★ · 2021-03-14
- p0wershe11/ProxyLogon124★ · 2021-03-17
- praetorian-inc/proxylogon-exploit52★ · 2021-03-24
- pussycat0x/CVE-2021-26855-SSRF24★ · 2021-03-10
- r0xDB/CVE-2021-2685512★ · 2024-01-01
- raheel0x01/CVE-2021-2685512★ · 2024-01-01
- saucer-man/exploit11★ · 2021-07-09
- srvaccount/CVE-2021-26855-PoC17★ · 2021-03-09
- stressboi/hafnium-exchange-splunk-csvs6★ · 2021-03-03
- thau0x01/poc_proxylogon8★ · 2022-02-10
- timb-machine-mirrors/testanull-CVE-2021-26855_read_poc.txt0★ · 2024-01-04
- yaoxiaoangry3/Flangvik0★ · 2021-10-30
- KotSec/CVE-2021-26855-Scanner
- SimoesCTT/CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-…
- SimoesCTT/CTT-ProxyLogon-RCE-v1.0---Convergent-Time-Theory-Enhanced-Microsoft-Exchange-Ex…
- alt3kx/CVE-2021-26855_PoC
- haotiku/CVE-2021-26855-exploit-Exchange
- wysssadda/ExchangeSmash
Nuclei templates (1)
Metasploit modules (1)
ExploitDB entries (4)
- https://www.exploit-db.com/exploits/49895
- https://www.exploit-db.com/exploits/49879
- https://www.exploit-db.com/exploits/49663
- https://www.exploit-db.com/exploits/49637
Exploit collections (3)
- chaitin/xray/blob/master/pocs/exchange-cve-2021-26855-ssrf.yml
- tzwlhack/Vulnerability/blob/main/Microsoft%20Exchange%20SSRF%EF%BC%88CVE-2021-26855%EF%BC…
- zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2021/CVE-2021-26855.yaml