{"id":"CVE-2021-27065","kind":"vulnerability","aliases":["CVE-2021-27065"],"related":[],"title":"Microsoft Exchange Server: Microsoft Exchange Server Remote Code Execution Vulnerability","description":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Exchange Server has an unspecified flaw that allows remote code execution, and it is part of the ProxyLogon chain. Attackers exploit it in the wild, and KEV notes ransomware use.","severity":"critical","cvss":7.8,"epss":0.99876,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Exchange Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exchange-server","exploited","infrastructure","on-prem-exchange","ransomware","windows"],"not_affected_if":["exchange-online","microsoft-365"],"how_to_check":null,"fix":"Apply the Microsoft updates for Exchange Server per vendor instructions (CISA required action); exact build numbers are unknown from the sources.","status":"open","published_at":"2021-03-03T00:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:24+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:41:24Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Exchange Server per vendor instructions (CISA required action); exact build numbers are unknown from the sources.","reach":"internet","impact":"high","summary":"Microsoft Exchange Server has an unspecified flaw that allows remote code execution, and it is part of the ProxyLogon chain. Attackers exploit it in the wild, and KEV notes ransomware use.","category":"infrastructure","who_cares":["exchange-server","on-prem-exchange","windows"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs code on the Exchange server and can reach mailboxes.","analyst_note":"Find the affected and fixed Exchange build numbers and a detection method (such as IOC or web shell checks) from the Microsoft advisory for CVE-2021-27065 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["exchange-online","microsoft-365"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000477,"input_tokens":2848,"output_tokens":384,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Exchange build numbers and a detection method (such as IOC or web shell checks) from the Microsoft advisory for CVE-2021-27065 and the CISA KEV entry.","search":"'-2021':12A,15A '-27065':13A,16A 'action':86C 'allow':39B,70C 'appli':87C 'attack':51B 'chain':50B,83C 'cisa':84C 'code':8A,41B,73C 'contain':65C 'cve':11A,14A 'exchang':2A,5A,21B,28B,32B,63C 'exchange':18A 'exchange-serv':20B 'execut':9A,42B,74C 'exploit':23B,52B,82C 'flaw':37B 'infrastructur':24B 'instruct':91C 'kev':58B 'microsoft':1A,4A,17A,31B,62C 'note':59B 'on-prem-exchang':25B 'part':46B,78C 'per':89C 'prem':27B 'proxylogon':49B,81C 'ransomwar':29B,60B 'remot':7A,40B,72C 'requir':85C 'server':3A,6A,19A,22B,33B,64C 'unspecifi':36B,67C 'updat':88C 'use':61B 'vendor':90C 'vulner':10A,68C,76C 'wild':56B 'window':30B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-03T00:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-27065","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27065","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:33+00:00","note":null},{"source":"epss","external_id":"CVE-2021-27065","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27065","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-27065","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27065","severity":null,"published_at":"2021-03-03T00:15:12+00:00","modified_at":"2026-10-01T21:17:17+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}