CVE-2021-26855
Microsoft Exchange Server Remote Code Execution Vulnerability
Description
CVE-2021-26855 is a critical-severity server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server, widely known as part of the ProxyLogon exploit chain. This vulnerability allows an unauthenticated attacker to send crafted HTTP requests to a vulnerable Exchange Server and exploit the SSRF flaw to access internal services and exfiltrate sensitive data such as email contents. CVE-2021-26855 is the initial entry point in the ProxyLogon attack chain, which when combined with other vulnerabilities enables full remote code execution on the Exchange Server. CISA has added CVE-2021-26855 to its Known Exploited Vulnerabilities catalog and issued Emergency Directive 21-02, confirming widespread active exploitation. With an EPSS score of 94.31% (99.95th percentile) and confirmed ransomware usage, this Microsoft Exchange Server vulnerability demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2013; 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
- http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) is a vulnerability where an attacker can induce the server-side application to make HTTP requests to an arbitrary domain or internal resource of the attacker's choosing. In CVE-2021-26855, the Microsoft Exchange Server can be tricked into authenticating to arbitrary URLs and forwarding internal requests, allowing an unauthenticated attacker to read emails from mailboxes and access internal backend services.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2021-26855 carries a CVSS 3.1 score of 9.1 (CRITICAL) from the vendor and 9.8 from NVD, indicating a maximum-severity threat to Microsoft Exchange Server deployments. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and requires no user interaction — making it trivially exploitable by any attacker with network access to the Exchange Server. Confidentiality (High): An attacker can read the full contents of any mailbox on the server, accessing sensitive emails, attachments, and address books. Integrity (High): Combined with other ProxyLogon chain vulnerabilities, an attacker can write arbitrary files to the server, install web shells, and modify system configurations. The EPSS score of 94.31% and confirmed ransomware usage place CVE-2021-26855 among the most actively exploited and dangerous vulnerabilities in recent history, with mass exploitation campaigns affecting tens of thousands of organizations globally.
Exploit Maturity
Public exploit code is available for CVE-2021-26855 via multiple sources including Microsoft Exchange SSRF and Arbitrary File Write, ProxyLogon Remote Code Execution, Unauthenticated Email Download, and ProxyLogon Collector. CISA has confirmed active exploitation through Emergency Directive 21-02 and the KEV catalog. Ransomware usage is confirmed as "Known," with multiple ransomware families leveraging ProxyLogon for initial access. The EPSS score of 94.31% (99.95th percentile) indicates near-certain exploitation activity. CVE-2021-26855 is commonly chained with CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to achieve full remote code execution on vulnerable Exchange Servers.
Remediation
- Apply vendor patches immediately as mandated by CISA Emergency Directive 21-02: Apply updates per vendor instructions. Microsoft released emergency out-of-band security updates in March 2021 for Exchange Server 2013, 2016, and 2019.
- Verify that all Microsoft Exchange Server instances (2013, 2016, 2019) have been updated to the patched cumulative updates. Run the Microsoft Exchange Server Health Checker tool (HealthChecker.ps1) to verify patch status and identify misconfigurations.
- Check for indicators of compromise including web shells in IIS directories (commonly aspx files in paths like /aspnet_client/), unexpected processes spawned by w3wp.exe, and anomalous Exchange Server log entries. Microsoft released the MSERT tool and Test-ProxyLogon.ps1 script specifically for detecting ProxyLogon exploitation.
- If compromise is suspected, assume the attacker had full access to all email data and potentially established persistence. Conduct a thorough incident response including credential rotation for all accounts, web shell removal, and forensic analysis of Exchange Server logs.
- As a long-term hardening measure, restrict external access to Exchange Server to only necessary ports, implement a web application firewall (WAF) in front of Exchange, and consider migration to Exchange Online (Microsoft 365) to reduce on-premises attack surface.
Technical Details
CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability (CWE-918) in the Microsoft Exchange Server's Autodiscover and OWA proxy components. The flaw allows an unauthenticated attacker to craft specific HTTP requests that cause the Exchange Server to authenticate and forward requests to arbitrary internal backend services. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that this is a network-based attack requiring no privileges or user interaction, with high impact on confidentiality and integrity. As part of the ProxyLogon chain, CVE-2021-26855 serves as the initial SSRF to bypass authentication, which is then chained with CVE-2021-27065 (an arbitrary file write vulnerability) to deploy web shells, achieving full remote code execution. The attack targets the Exchange Server's backend API endpoints that are normally only accessible from the server itself.
Frequently Asked Questions
Is CVE-2021-26855 being actively exploited?
Yes. CVE-2021-26855 (ProxyLogon) is one of the most widely exploited vulnerabilities in recent years. CISA issued Emergency Directive 21-02 specifically for this vulnerability. Ransomware usage is confirmed, and mass exploitation campaigns affected tens of thousands of organizations. The EPSS score of 94.31% (99.95th percentile) indicates near-certain exploitation.
What products are affected by CVE-2021-26855?
CVE-2021-26855 affects Microsoft Exchange Server versions 2013, 2016, and 2019. Exchange Online (Microsoft 365) is not affected. Organizations running on-premises Exchange Servers should verify patch status immediately using the HealthChecker.ps1 tool.
How do I fix CVE-2021-26855?
Apply the emergency security updates released by Microsoft in March 2021 for Exchange Server 2013, 2016, and 2019. Run Microsoft's MSERT tool and Test-ProxyLogon.ps1 script to check for indicators of compromise. If exploitation is suspected, conduct a full incident response including web shell removal and credential rotation.
How severe is CVE-2021-26855?
CVE-2021-26855 has a CVSS 3.1 score of 9.1-9.8 (CRITICAL). It is the primary entry point for the ProxyLogon attack chain, which enables unauthenticated remote code execution on Exchange Servers. With confirmed ransomware usage and mass exploitation, this is among the most critical vulnerabilities ever discovered in Microsoft Exchange.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.