CVE-2021-26858

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Affected

Microsoft · Microsoft Exchange Server 2013 Cumulative Update 21 · Microsoft Exchange Server 2013 Cumulative Update 22 · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 10 · Microsoft Exchange Server 2016 Cumulative Update 11 · Microsoft Exchange Server 2016 Cumulative Update 12

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

93.65% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03, used in ransomware campaigns

Published

2021-03-02

Updated

2026-10-01

Proof-of-concept exploits (3)

• Ahsanzia/Exchange-Exploit5★ · 2021-03-05
• Yt1g3r/CVE-2021-26855_SSRF4★ · 2021-03-11
• trymonoly/ProxyLogon1★ · 2024-10-09

Security advisories

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858

References

• CVE Record
• NVD entry

Related

• CVE-2021-26855
• CVE-2021-26857
• CVE-2021-27065
• CVE-2018-8174
• CVE-2019-3396
• CVE-2020-0688