CVE-2021-26857
Microsoft Exchange Server Remote Code Execution Vulnerability
Description
CVE-2021-26857 is a high-severity remote code execution vulnerability affecting Microsoft Exchange Server. This vulnerability is part of the ProxyLogon exploit chain and stems from an insecure deserialization weakness in the Exchange Server's Unified Messaging service. An attacker who exploits this deserialization flaw can execute arbitrary code on the target server. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it is associated with known ransomware campaigns. With an EPSS score of 42.05% (97.4th percentile), CVE-2021-26857 represents a significant threat requiring immediate attention from organizations running on-premises Exchange deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2010; 2013; 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of Untrusted Data is a vulnerability that occurs when an application deserializes data from an untrusted source without proper validation. In the context of CVE-2021-26857, the Microsoft Exchange Server Unified Messaging service deserializes attacker-controlled data, allowing the execution of arbitrary code as SYSTEM on the Exchange server. This deserialization weakness is a critical component of the ProxyLogon attack chain.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2021-26857 carries a CVSS 3.1 score of 7.8 (HIGH), indicating a significant security threat to affected Exchange Server deployments. While the attack vector is classified as local with user interaction required, this vulnerability is typically chained with other ProxyLogon vulnerabilities (CVE-2021-26855, CVE-2021-26858, CVE-2021-27065) to achieve full remote exploitation. Confidentiality (High): Successful exploitation grants access to all email data, credentials, and sensitive information stored on the Exchange server. Integrity (High): Attackers can modify mailbox content, deploy web shells, and alter Exchange configurations. Availability (High): Compromise can lead to complete service disruption, data exfiltration, and deployment of ransomware. The association with known ransomware campaigns significantly elevates the risk, as threat actors have used the ProxyLogon chain for deploying DearCry and other ransomware variants against unpatched Exchange servers.
Exploit Maturity
CVE-2021-26857 is part of the widely exploited ProxyLogon attack chain that targeted Microsoft Exchange Servers globally. CISA has confirmed active exploitation in the wild and has associated this vulnerability with known ransomware campaigns, making it a top-priority remediation target. The EPSS score of 42.05% (97.4th percentile) indicates a high probability of exploitation. While no standalone public exploit was identified in the NVD references for this specific CVE, the ProxyLogon chain (combining CVE-2021-26855 for initial SSRF access, CVE-2021-26857 for deserialization-based code execution, and CVE-2021-26858/CVE-2021-27065 for arbitrary file write) has been extensively documented and weaponized by multiple threat actor groups. CISA issued Emergency Directive 21-02 specifically addressing this vulnerability chain.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV and Emergency Directive 21-02: Apply updates per vendor instructions. Microsoft has released cumulative security updates for all supported Exchange Server versions.
- Update all instances of Microsoft Exchange Server (2010, 2013, 2016, 2019) to the latest patched cumulative updates. Verify patch installation via the Exchange Server Health Checker tool.
- If immediate patching is not feasible, take the Exchange server offline or disconnect it from the network until patches can be applied. Disable the Unified Messaging service if it is not required, as it is the specific attack surface for this deserialization vulnerability.
- Conduct thorough forensic investigation of Exchange servers for indicators of compromise, including web shells in IIS directories, suspicious w3wp.exe child processes, and unauthorized modifications to Exchange configuration. Reference CISA's ED 21-02 guidance at https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities.
- Implement long-term hardening measures including network segmentation for Exchange servers, strict input validation on all deserialization endpoints, regular security auditing of Exchange configurations, and consider migration to Exchange Online to reduce on-premises attack surface.
Technical Details
CVE-2021-26857 exploits an insecure deserialization weakness (CWE-502) in the Microsoft Exchange Server Unified Messaging service. The vulnerability allows an attacker to supply maliciously crafted serialized data to the Unified Messaging service, which is deserialized without proper validation, resulting in arbitrary code execution as SYSTEM. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local access with user interaction required, but in practice this vulnerability is chained with CVE-2021-26855 (a server-side request forgery vulnerability) to achieve unauthenticated remote exploitation. The combined ProxyLogon chain allows an attacker to authenticate as the Exchange server, exploit the deserialization flaw for code execution, and then use CVE-2021-26858 or CVE-2021-27065 to write arbitrary files to disk, enabling persistent access via web shells.
Frequently Asked Questions
Is CVE-2021-26857 being actively exploited?
Yes. CVE-2021-26857 is listed in the CISA Known Exploited Vulnerabilities catalog and is associated with known ransomware campaigns. It is part of the ProxyLogon exploit chain that was massively exploited against Microsoft Exchange Servers worldwide. CISA issued Emergency Directive 21-02 specifically addressing this vulnerability.
What products are affected by CVE-2021-26857?
CVE-2021-26857 affects Microsoft Exchange Server versions 2010, 2013, 2016, and 2019. All on-premises Exchange deployments running these versions without the security updates are vulnerable.
How do I fix CVE-2021-26857?
Apply the cumulative security updates provided by Microsoft immediately. Verify patch installation using the Exchange Server Health Checker. If patching is not immediately possible, disconnect the Exchange server from the network and disable the Unified Messaging service. Conduct forensic investigation for indicators of compromise per CISA ED 21-02 guidance.
How severe is CVE-2021-26857?
CVE-2021-26857 has a CVSS 3.1 score of 7.8 (HIGH). Its severity is amplified by being part of the ProxyLogon exploit chain and its association with ransomware campaigns. The EPSS score of 42.05% (97.4th percentile) confirms a high exploitation probability. Immediate remediation is essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.