Skip to main content

Exchange Server CVE-2021-26855

CRITICAL
Server-Side Request Forgery (SSRF) (CWE-918)
2021-03-03 secure@microsoft.com
RCE SSRF Microsoft Exchange Server
9.1
CVSS 3.1 · Vendor: microsoft
View

Vulnerability Assessment

Weakness
CWE
CWE-918
OWASP Top 10:2025
A10:2021 - Server-Side Request Forgery
ASVS 5.0
V12 - Files and Resources SSRF prevention, URL validation
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Credential Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

Maximum risk (CVSS 9.1, EPSS 94%). HAFNIUM exploited ProxyLogon as a zero-day from January 2021. After disclosure in March 2021, mass exploitation by dozens of groups compromised an estimated 250,000+ Exchange servers worldwide within weeks. The scale was unprecedented.
Exploit ScenarioDerived

An attacker sends a crafted autodiscover request to an internet-facing Exchange server, exploiting the SSRF to authenticate to the backend as SYSTEM. They then chain CVE-2021-27065 to write a web shell (typically 'China Chopper') to a web-accessible directory, providing persistent remote code execution on the Exchange server.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 94.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability known as 'ProxyLogon' that allows unauthenticated attackers to access Exchange backend services, chain with other vulnerabilities for full server compromise. The most impactful Exchange vulnerability in history.

Earlier versions of this analysis (1)
v1 Mar 26, 2026 - 11:19 CVSS 9.1

A critical SSRF vulnerability in Microsoft Exchange Server's Client Access Service allows unauthenticated attackers to forge requests to internal Exchange services. Known as 'ProxyLogon,' this was the anchor vulnerability in the most devastating Exchange attack campaign ever, attributed to HAFNIUM (Chinese state-sponsored).

RemediationAI

Apply Microsoft security updates immediately. Run the MSERT tool to detect web shells. Check for indicators of compromise (aspx files in OWA/ECP directories, suspicious PowerShell execution). Assume compromise if running vulnerable versions during the exploitation window.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The CWE-918 SSRF in Exchange's autodiscover endpoint allows an unauthenticated attacker to send crafted requests that the Exchange server forwards to its backend services as SYSTEM. This bypass of authentication is chained with CVE-2021-26857 (deserialization), CVE-2021-26858, and CVE-2021-27065 (file write) for complete server compromise.

Know when Exchange Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Added to CISA KEV
Dec 18, 2025 - 02:00 cisa
CISA KEV
PoC Detected
Dec 18, 2025 - 02:00 vuln.today
Public exploit code
Patch released
Dec 18, 2025 - 02:00 nvd
Patch available
CVE Published
Mar 03, 2021 - 00:15 nvd
CRITICAL 9.1

DescriptionCVE.org

Microsoft Exchange Server Remote Code Execution Vulnerability

Executive ViewAI

Why It Matters

CVE-2021-26855 presents critical security risk, a server-side request forgery vulnerability rated CVSS 9.1. Attackers could trick authenticated users into performing unintended actions, potentially modifying critical settings or data. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. A patch is available and should be applied immediately given the critical severity.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement strict egress filtering; (2) Use allowlists for outbound connections; (3) Block access to cloud metadata endpoints.

Threat Intelligence Overview

Threat Score
9.6/10
Composite threat intelligence
EPSS Score
94.0%
Top 0% exploitable
Threat Intel
6
1 sources
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
NVD CVE.org CISA KEV EPSS POC (4) THREAT Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV Yes
Public POC Yes
EPSS 94.0%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Very High

Priority Score

235
Low Medium High Critical
KEV: +50
EPSS: +94
CVSS: +46
PoC: +20
Weaponized: +15
Threat intel: +10
Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
+ 4 more

More in Exchange Server

View all
CVE-2021-34473 CRITICAL POC
9.1 Jul 14

Microsoft Exchange Server contains a pre-authentication SSRF vulnerability known as 'ProxyShell' that allows unauthentic
CVE-2021-34523 CRITICAL POC
9.0 Jul 14

Microsoft Exchange Server contains a privilege escalation vulnerability in the PowerShell backend that allows authentica
CVE-2021-27065 HIGH POC
7.8 Mar 03

Microsoft Exchange Server allows post-authentication arbitrary file write that enables web shell deployment, the primary
CVE-2021-42321 HIGH POC
8.8 Nov 10

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is rem
CVE-2021-33766 HIGH POC
7.3 Jul 14

Microsoft Exchange Server Information Disclosure Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is re
CVE-2022-41080 HIGH
8.8 Nov 09

Microsoft Exchange Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-26858 HIGH
7.8 Mar 03

Microsoft Exchange Server allows authenticated attackers to write arbitrary files to the server filesystem, the third co
CVE-2023-21529 HIGH POC
8.8 Feb 14

Remote code execution in Microsoft Exchange Server 2013, 2016, and 2019 allows authenticated attackers to execute arbitr
CVE-2021-41349 MEDIUM POC
6.5 Nov 10

Microsoft Exchange Server Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely explo
CVE-2021-26857 HIGH
7.8 Mar 03

Microsoft Exchange Server Unified Messaging service contains a deserialization vulnerability that allows authenticated a
CVE-2021-31196 HIGH
7.2 Jul 14

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is rem
CVE-2023-21707 HIGH
8.8 Feb 14

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is rem

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Threat IntelligenceMISP

Threat Actors
Threat Group-3390 Magic Hound ToddyCat APT41
ATT&CK Techniques (observed)
T1190 - Exploit Public-Facing Application T1595.002 - Vulnerability Scanning
Sources: MITRE ATT&CK, Metasploit/Nuclei

References

Advisories & patches
PATCH https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 REF https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy