What’s Vulnerable › Vulnerabilities

CVE-2021-26857: Microsoft Exchange Server Remote Code Execution Vulnerability

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 95.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-02 · updated 2026-08-19
• Weakness: CWE-502

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Affected products

• Microsoft Exchange Server: 2010-sp3, 2013-cumulative_update_21, 2013-cumulative_update_22, 2013-cumulative_update_23, 2013-sp1, 2016-cumulative_update_10 (+19); 2019
• Microsoft Exchange Server 2010 Service Pack 3: from 14.0.0.0 before 14.03.0513.000 — fixed in 14.03.0513.000
• Microsoft Exchange Server 2013 Cumulative Update 21: from 15.00.0 before 15.00.1395.012 — fixed in 15.00.1395.012
• Microsoft Exchange Server 2013 Cumulative Update 22: from 15.00.0 before 15.00.1473.006 — fixed in 15.00.1473.006
• Microsoft Exchange Server 2013 Cumulative Update 23: from 15.00.0 before 15.00.1497.012 — fixed in 15.00.1497.012
• Microsoft Exchange Server 2013 Service Pack 1: from 15.00.0 before 15.00.0847.064 — fixed in 15.00.0847.064
• Microsoft Exchange Server 2016 Cumulative Update 10: from 15.01.0 before 15.01.1531.012 — fixed in 15.01.1531.012
• Microsoft Exchange Server 2016 Cumulative Update 11: from 15.01.0 before 15.01.1591.018 — fixed in 15.01.1591.018
• Microsoft Exchange Server 2016 Cumulative Update 12: from 15.01.0 before 15.01.1713.010 — fixed in 15.01.1713.010
• Microsoft Exchange Server 2016 Cumulative Update 13: from 15.01.0 before 15.01.1779.008 — fixed in 15.01.1779.008
• Microsoft Exchange Server 2016 Cumulative Update 14: from 15.01.0 before 15.01.1847.012 — fixed in 15.01.1847.012
• Microsoft Exchange Server 2016 Cumulative Update 15: from 15.01.0 before 15.01.1913.012 — fixed in 15.01.1913.012
• Microsoft Exchange Server 2016 Cumulative Update 16: from 15.01.0 before 15.01.1979.008 — fixed in 15.01.1979.008
• Microsoft Exchange Server 2016 Cumulative Update 17: from 15.01.0 before 15.01.2044.013 — fixed in 15.01.2044.013
• Microsoft Exchange Server 2016 Cumulative Update 18: from 15.01.0 before 15.01.2106.013 — fixed in 15.01.2106.013
• Microsoft Exchange Server 2016 Cumulative Update 19: from 15.01.0 before 15.01.2176.009 — fixed in 15.01.2176.009
• Microsoft Exchange Server 2016 Cumulative Update 8: from 15.01.0 before 15.01.1415.010 — fixed in 15.01.1415.010
• Microsoft Exchange Server 2016 Cumulative Update 9: from 15.01.0 before 15.01.1466.016 — fixed in 15.01.1466.016
• Microsoft Exchange Server 2019: from 15.02.0 before 15.02.0221.018 — fixed in 15.02.0221.018
• Microsoft Exchange Server 2019 Cumulative Update 1: from 15.02.0 before 15.01.1979.006 — fixed in 15.01.1979.006
• Microsoft Exchange Server 2019 Cumulative Update 2: from 15.02.0 before 15.02.0397.011 — fixed in 15.02.0397.011
• Microsoft Exchange Server 2019 Cumulative Update 3: from 15.02.0 before 15.02.0464.015 — fixed in 15.02.0464.015
• Microsoft Exchange Server 2019 Cumulative Update 4: from 15.02.0 before 15.02.0659.012 — fixed in 15.02.0659.012
• Microsoft Exchange Server 2019 Cumulative Update 5: from 15.02.0 before 15.02.0595.008 — fixed in 15.02.0595.008
• Microsoft Exchange Server 2019 Cumulative Update 6: from 15.02.0 before 15.02.0529.013 — fixed in 15.02.0529.013
• Microsoft Exchange Server 2019 Cumulative Update 7: from 15.02.0 before 15.02.0721.013 — fixed in 15.02.0721.013
• Microsoft Exchange Server 2019 Cumulative Update 8: from 15.02.0 before 15.02.0792.010 — fixed in 15.02.0792.010

How to fix

Upgrade to a fixed version: Microsoft Exchange Server 2010 Service Pack 3 14.03.0513.000; Microsoft Exchange Server 2013 Cumulative Update 21 15.00.1395.012; Microsoft Exchange Server 2013 Cumulative Update 22 15.00.1473.006; Microsoft Exchange Server 2013 Cumulative Update 23 15.00.1497.012; Microsoft Exchange Server 2013 Service Pack 1 15.00.0847.064; Microsoft Exchange Server 2016 Cumulative Update 10 15.01.1531.012; Microsoft Exchange Server 2016 Cumulative Update 11 15.01.1591.018; Microsoft Exchange Server 2016 Cumulative Update 12 15.01.1713.010; Microsoft Exchange Server 2016 Cumulative Update 13 15.01.1779.008; Microsoft Exchange Server 2016 Cumulative Update 14 15.01.1847.012; Microsoft Exchange Server 2016 Cumulative Update 15 15.01.1913.012; Microsoft Exchange Server 2016 Cumulative Update 16 15.01.1979.008. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26857
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26857

Get alerted when CVE-2021-26857 or the next vulnerability affects your stack