{"id":"CVE-2021-26858","kind":"vulnerability","aliases":["CVE-2021-26858"],"related":[],"title":"Microsoft Exchange Server: Microsoft Exchange Server Remote Code Execution Vulnerability","description":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Exchange Server has an unspecified flaw that allows remote code execution, and it is part of the ProxyLogon chain. Attackers are exploiting it in the wild and it is tagged as used in ransomware campaigns.","severity":"critical","cvss":7.8,"epss":0.93651,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Exchange Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exchange-server","exploited","infrastructure","on-premises-exchange","ransomware","windows"],"not_affected_if":["exchange-online","microsoft-365-hosted"],"how_to_check":null,"fix":"Apply the Microsoft updates for Exchange Server per vendor instructions (CISA KEV required action); the specific build numbers are not in the sources.","status":"open","published_at":"2021-03-03T00:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:20+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:37:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Exchange Server per vendor instructions (CISA KEV required action); the specific build numbers are not in the sources.\nunknown","reach":"internet","impact":"high","summary":"Microsoft Exchange Server has an unspecified flaw that allows remote code execution, and it is part of the ProxyLogon chain. Attackers are exploiting it in the wild and it is tagged as used in ransomware campaigns.","category":"infrastructure","who_cares":["exchange-server","on-premises-exchange","windows"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the Exchange server and can reach mailboxes and credentials.","analyst_note":"Find the affected and fixed Exchange build numbers and the Microsoft advisory (KB for ProxyLogon, March 2021) plus IOC/detection guidance; check the KEV page and Microsoft Security Response Center for exact versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["exchange-online","microsoft-365-hosted"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000495,"input_tokens":2848,"output_tokens":421,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Exchange build numbers and the Microsoft advisory (KB for ProxyLogon, March 2021) plus IOC/detection guidance; check the KEV page and Microsoft Security Response Center for exact versions.","search":"'-2021':12A,15A '-26858':13A,16A 'action':91C 'allow':39B,75C 'appli':92C 'attack':51B 'campaign':66B 'chain':50B,88C 'cisa':89C 'code':8A,41B,78C 'contain':70C 'cve':11A,14A 'exchang':2A,5A,21B,28B,32B,68C 'exchange':18A 'exchange-serv':20B 'execut':9A,42B,79C 'exploit':23B,53B,87C 'flaw':37B 'infrastructur':24B 'instruct':96C 'microsoft':1A,4A,17A,31B,67C 'on-premises-exchang':25B 'part':46B,83C 'per':94C 'premis':27B 'proxylogon':49B,86C 'ransomwar':29B,65B 'remot':7A,40B,77C 'requir':90C 'server':3A,6A,19A,22B,33B,69C 'tag':61B 'unspecifi':36B,72C 'updat':93C 'use':63B 'vendor':95C 'vulner':10A,73C,81C 'wild':57B 'window':30B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-03T00:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-26858","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-26858","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T12:39:25+00:00","note":null},{"source":"epss","external_id":"CVE-2021-26858","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-26858","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-26858","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26858","severity":null,"published_at":"2021-03-03T00:15:12+00:00","modified_at":"2026-10-01T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}