CVE-2021-27065
Microsoft Exchange Server Remote Code Execution Vulnerability
Description
CVE-2021-27065 is a high-severity remote code execution vulnerability in Microsoft Exchange Server, forming a critical component of the ProxyLogon exploit chain. The vulnerability involves a path traversal flaw that allows an authenticated attacker to write arbitrary files to the server. When chained with CVE-2021-26855 (the SSRF vulnerability providing unauthenticated access), an attacker can deploy web shells and achieve full remote code execution without valid credentials. CISA has added CVE-2021-27065 to its Known Exploited Vulnerabilities catalog and included it in Emergency Directive 21-02, confirming widespread active exploitation. With an EPSS score of 94.28% (99.94th percentile) and confirmed ransomware usage, this Exchange Server vulnerability is among the most actively exploited in recent history.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2013; 2016; 2019 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065
- http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27065(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path Traversal is a vulnerability where software uses external input to construct a file path without properly neutralizing special characters that could resolve outside the intended directory. In CVE-2021-27065, the Microsoft Exchange Server fails to properly validate file paths in its Virtual Directory management functionality, allowing an authenticated attacker to write files to arbitrary locations on the server, including executable web shell files in IIS-accessible directories.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2021-27065 carries a CVSS 3.1 score of 7.8 (HIGH), reflecting significant risk to Microsoft Exchange Server deployments. The attack vector is classified as local with low attack complexity, requiring no privileges but needing user interaction. Confidentiality (High): Successful exploitation exposes all data on the Exchange Server, including email contents, address books, and configuration data across all mailboxes. Integrity (High): The path traversal file write capability allows attackers to modify system files, deploy web shells in IIS directories, and alter Exchange Server configurations to maintain persistent access. Availability (High): Attackers can disrupt Exchange Server operations through file manipulation or by deploying destructive payloads. The EPSS score of 94.28% indicates near-certain exploitation, and confirmed ransomware usage demonstrates that threat actors actively leverage CVE-2021-27065 as part of the ProxyLogon chain for mass exploitation campaigns affecting organizations worldwide.
Exploit Maturity
Public exploit code is available for CVE-2021-27065 via Microsoft Exchange ProxyLogon Remote Code Execution and Microsoft Exchange ProxyLogon Collector. CISA has confirmed active exploitation through Emergency Directive 21-02 and the KEV catalog. Ransomware usage is confirmed as "Known," with threat actors using the ProxyLogon chain for initial access followed by ransomware deployment. The EPSS score of 94.28% (99.94th percentile) indicates near-certain exploitation activity. CVE-2021-27065 is the primary file-write component in the ProxyLogon chain, commonly exploited together with CVE-2021-26855 (SSRF) to achieve unauthenticated web shell deployment on vulnerable Exchange Servers. This combination has been used in mass exploitation campaigns attributed to multiple state-sponsored and criminal threat actors.
Remediation
- Apply vendor patches immediately as mandated by CISA Emergency Directive 21-02: Apply updates per vendor instructions. Microsoft released emergency out-of-band security updates in March 2021 for Exchange Server 2013, 2016, and 2019.
- Verify that all Microsoft Exchange Server instances (2013, 2016, 2019) have been updated to the latest patched cumulative updates. Use the Microsoft Exchange Server Health Checker tool (HealthChecker.ps1) and the Exchange Mitigation Tool (EOMT) to verify patch status.
- Search for web shells and indicators of compromise in common deployment locations including /aspnet_client/, /owa/auth/, and Exchange-related directories. Use Microsoft's MSERT tool, Test-ProxyLogon.ps1 script, and the CISA-published Sparrow.ps1 tool for comprehensive detection of ProxyLogon exploitation artifacts.
- If web shells or other indicators of compromise are found, initiate a full incident response: preserve forensic evidence, identify the scope of compromise, rotate all credentials (including service accounts), remove all malicious files, and assess whether lateral movement occurred. Assume all email data was accessible to the attacker.
- Implement long-term hardening measures including restricting external access to Exchange Server via VPN or reverse proxy, deploying a web application firewall with rules for path traversal detection, enabling detailed IIS and Exchange logging, and planning migration to Exchange Online (Microsoft 365) to reduce the on-premises attack surface.
Technical Details
CVE-2021-27065 is a path traversal vulnerability (CWE-22) in Microsoft Exchange Server's Virtual Directory configuration functionality. The flaw allows an authenticated attacker to write arbitrary files with controlled content to any location on the Exchange Server by manipulating the file path in the Virtual Directory configuration. The CVSS vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack vector with low complexity and no privilege requirements, though user interaction is needed. In the ProxyLogon attack chain, CVE-2021-26855 first provides unauthenticated SSRF access to Exchange backend services, and then CVE-2021-27065 is used to write a web shell (typically an aspx file containing a China Chopper or similar web shell) to an IIS-accessible directory. The path traversal component allows the attacker to escape the intended directory restrictions and place the web shell in a location that can be reached via HTTP, establishing persistent remote access to the compromised server.
Frequently Asked Questions
Is CVE-2021-27065 being actively exploited?
Yes. CVE-2021-27065 is one of the most actively exploited components of the ProxyLogon chain. CISA issued Emergency Directive 21-02, and the vulnerability is listed in the KEV catalog. Ransomware usage is confirmed, and mass exploitation campaigns affected tens of thousands of organizations globally. The EPSS score of 94.28% (99.94th percentile) indicates near-certain exploitation.
What products are affected by CVE-2021-27065?
CVE-2021-27065 affects Microsoft Exchange Server versions 2013, 2016, and 2019. Exchange Online (Microsoft 365) is not affected. All organizations running on-premises Exchange Servers should verify patch status immediately and scan for indicators of compromise.
How do I fix CVE-2021-27065?
Apply the emergency security updates released by Microsoft in March 2021. Run Microsoft's detection tools (MSERT, Test-ProxyLogon.ps1, and EOMT) to identify indicators of compromise. If exploitation is detected, conduct a comprehensive incident response including web shell removal, credential rotation for all accounts, and forensic investigation.
How severe is CVE-2021-27065?
CVE-2021-27065 has a CVSS 3.1 score of 7.8 (HIGH). As the primary file-write component of the ProxyLogon exploit chain, it is essential for achieving remote code execution when combined with CVE-2021-26855. With an EPSS score of 94.28% and confirmed ransomware usage, this vulnerability demands immediate remediation priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.