{"id":"CVE-2021-26855","kind":"vulnerability","aliases":["CVE-2021-26855"],"related":[],"title":"Microsoft Exchange Server: Microsoft Exchange Server Remote Code Execution Vulnerability","description":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Exchange Server has a remote code execution flaw, part of the ProxyLogon chain, that is actively exploited in the wild and tied to ransomware use. An unauthenticated attacker who reaches the Exchange server over the network can run code on it.","severity":"critical","cvss":9.8,"epss":0.99996,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Exchange Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exchange-server","exploited","on-premises","ransomware","vendor","windows"],"not_affected_if":["exchange-online","microsoft-365"],"how_to_check":null,"fix":"Apply Microsoft's updates for CVE-2021-26855 per vendor instructions (CISA required action); the specific patched build numbers are not in the sources.","status":"open","published_at":"2021-03-03T00:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:29+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:37:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply Microsoft's updates for CVE-2021-26855 per vendor instructions (CISA required action); the specific patched build numbers are not in the sources.","reach":"internet","impact":"high","summary":"Microsoft Exchange Server has a remote code execution flaw, part of the ProxyLogon chain, that is actively exploited in the wild and tied to ransomware use. An unauthenticated attacker who reaches the Exchange server over the network can run code on it.","category":"vendor","who_cares":["exchange-server","on-premises","windows"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code on the Exchange server and can take over the mail system","analyst_note":"Find the Microsoft security advisory and patched build numbers for CVE-2021-26855 and the Exchange compromise-check guidance (e.g. Microsoft's ProxyLogon IOC/Health Checker script) to fill how_to_check and fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["exchange-online","microsoft-365"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000491,"input_tokens":2848,"output_tokens":412,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the Microsoft security advisory and patched build numbers for CVE-2021-26855 and the Exchange compromise-check guidance (e.g. Microsoft's ProxyLogon IOC/Health Checker script) to fill how_to_check and fix.","search":"'-2021':12A,15A '-26855':13A,16A 'action':94C 'activ':46B 'allow':78C 'appli':95C 'attack':58B 'chain':43B,91C 'cisa':92C 'code':8A,36B,69B,81C 'contain':73C 'cve':11A,14A 'exchang':2A,5A,21B,31B,62B,71C 'exchange':18A 'exchange-serv':20B 'execut':9A,37B,82C 'exploit':23B,47B,90C 'flaw':38B 'instruct':99C 'microsoft':1A,4A,17A,30B,70C 'network':66B 'on-premis':24B 'part':39B,86C 'per':97C 'premis':26B 'proxylogon':42B,89C 'ransomwar':27B,54B 'reach':60B 'remot':7A,35B,80C 'requir':93C 'run':68B 'server':3A,6A,19A,22B,32B,63B,72C 'tie':52B 'unauthent':57B 'unspecifi':75C 'updat':96C 'use':55B 'vendor':28B,98C 'vulner':10A,76C,84C 'wild':50B 'window':29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-03T00:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-26855","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-26855","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:33+00:00","note":null},{"source":"epss","external_id":"CVE-2021-26855","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26855","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-26855","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26855","severity":null,"published_at":"2021-03-03T00:15:12+00:00","modified_at":"2026-08-19T19:22:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}