What’s Vulnerable › Vulnerabilities

CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-02 · updated 2026-08-19
• Weakness: CWE-918

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Affected products

• Microsoft Exchange Server: 2013-cumulative_update_21, 2013-cumulative_update_22, 2013-cumulative_update_23, 2016-cumulative_update_10, 2016-cumulative_update_11, 2016-cumulative_update_12 (+17); 2019
• Microsoft Exchange Server 2013 Cumulative Update 21: from 15.00.0 before 15.00.1395.012 — fixed in 15.00.1395.012
• Microsoft Exchange Server 2013 Cumulative Update 22: from 15.00.0 before 15.00.1473.006 — fixed in 15.00.1473.006
• Microsoft Exchange Server 2013 Cumulative Update 23: from 15.00.0 before 15.00.1497.012 — fixed in 15.00.1497.012
• Microsoft Exchange Server 2016 Cumulative Update 10: from 15.01.0 before 15.01.1531.012 — fixed in 15.01.1531.012
• Microsoft Exchange Server 2016 Cumulative Update 11: from 15.01.0 before 15.01.1591.018 — fixed in 15.01.1591.018
• Microsoft Exchange Server 2016 Cumulative Update 12: from 15.01.0 before 15.01.1713.010 — fixed in 15.01.1713.010
• Microsoft Exchange Server 2016 Cumulative Update 13: from 15.01.0 before 15.01.1779.008 — fixed in 15.01.1779.008
• Microsoft Exchange Server 2016 Cumulative Update 14: from 15.01.0 before 15.01.1847.012 — fixed in 15.01.1847.012
• Microsoft Exchange Server 2016 Cumulative Update 15: from 15.01.0 before 15.01.1913.012 — fixed in 15.01.1913.012
• Microsoft Exchange Server 2016 Cumulative Update 16: from 15.01.0 before 15.01.1979.008 — fixed in 15.01.1979.008
• Microsoft Exchange Server 2016 Cumulative Update 17: from 15.01.0 before 15.01.2044.013 — fixed in 15.01.2044.013
• Microsoft Exchange Server 2016 Cumulative Update 18: from 15.01.0 before 15.01.2106.013 — fixed in 15.01.2106.013
• Microsoft Exchange Server 2016 Cumulative Update 19: from 15.01.0 before 15.01.2176.009 — fixed in 15.01.2176.009
• Microsoft Exchange Server 2016 Cumulative Update 8: from 15.01.0 before 15.01.1415.010 — fixed in 15.01.1415.010
• Microsoft Exchange Server 2016 Cumulative Update 9: from 15.01.0 before 15.01.1466.016 — fixed in 15.01.1466.016
• Microsoft Exchange Server 2019: from 15.02.0 before 15.02.0221.018 — fixed in 15.02.0221.018
• Microsoft Exchange Server 2019 Cumulative Update 1: from 15.02.0 before 15.01.1979.006 — fixed in 15.01.1979.006
• Microsoft Exchange Server 2019 Cumulative Update 2: from 15.02.0 before 15.02.0397.011 — fixed in 15.02.0397.011
• Microsoft Exchange Server 2019 Cumulative Update 3: from 15.02.0 before 15.02.0464.015 — fixed in 15.02.0464.015
• Microsoft Exchange Server 2019 Cumulative Update 4: from 15.02.0 before 15.02.0659.012 — fixed in 15.02.0659.012
• Microsoft Exchange Server 2019 Cumulative Update 5: from 15.02.0 before 15.02.0595.008 — fixed in 15.02.0595.008
• Microsoft Exchange Server 2019 Cumulative Update 6: from 15.02.0 before 15.02.0529.013 — fixed in 15.02.0529.013
• Microsoft Exchange Server 2019 Cumulative Update 7: from 15.02.0 before 15.02.0721.013 — fixed in 15.02.0721.013
• Microsoft Exchange Server 2019 Cumulative Update 8: from 15.02.0 before 15.02.0792.010 — fixed in 15.02.0792.010

How to fix

Upgrade to a fixed version: Microsoft Exchange Server 2013 Cumulative Update 21 15.00.1395.012; Microsoft Exchange Server 2013 Cumulative Update 22 15.00.1473.006; Microsoft Exchange Server 2013 Cumulative Update 23 15.00.1497.012; Microsoft Exchange Server 2016 Cumulative Update 10 15.01.1531.012; Microsoft Exchange Server 2016 Cumulative Update 11 15.01.1591.018; Microsoft Exchange Server 2016 Cumulative Update 12 15.01.1713.010; Microsoft Exchange Server 2016 Cumulative Update 13 15.01.1779.008; Microsoft Exchange Server 2016 Cumulative Update 14 15.01.1847.012; Microsoft Exchange Server 2016 Cumulative Update 15 15.01.1913.012; Microsoft Exchange Server 2016 Cumulative Update 16 15.01.1979.008; Microsoft Exchange Server 2016 Cumulative Update 17 15.01.2044.013; Microsoft Exchange Server 2016 Cumulative Update 18 15.01.2106.013. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
• http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html
• http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html
• http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855

Get alerted when CVE-2021-26855 or the next vulnerability affects your stack