CVE-2021-26855

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-26855 9.1

Microsoft · Exchange Server · Added 2021-11-03 · Published 2021-03-03

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityMicrosoft Exchange Server Remote Code Execution Vulnerability

VendorMicrosoft

ProductExchange Server

Date added2021-11-03

Due date2022-05-03

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-918

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Descriptions

KEV: Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

NVD: Microsoft Exchange Server Remote Code Execution Vulnerability

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-17 19:53 UTC

Wall time0.3s

Searches1

Component defaultyes

Sources https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
https://github.com/herwonowr/exprolog
https://github.com/alt3kx/CVE-2021-26855_PoC
https://github.com/praetorian-inc/proxylogon-exploit
https://www.praetorian.com/blog/reproducing-proxylogon-exploit/

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt IIS logs for POST /mapi/nspi/ from unauthenticated hosts and bursts of GETs to static /ecp/ or /owa/auth/ files; the X-BEResource=<host>~<n> SSRF cookie needs WAF or full-request capture, not stock IIS fields.

Research details

ComponentClient Access service (CAS) frontend-to-backend proxy, SSRF via attacker-controlled X-BEResource / X-AnonResource-Backend cookies

PreconditionsOn-premises Exchange Server 2013 CU21-23, 2016 CU8-19, or 2019 CU1-8 with the Client Access service exposed on HTTPS 443; no authentication required. The SSRF alone gives access to the Exchange backend (port 444) as the machine account; arbitrary code execution requires chaining with CVE-2021-27065 (authenticated arbitrary file write via OabVirtualDirectory) to drop a web shell. agent

DeliveryUnauthenticated HTTPS GETs to static frontend endpoints (/ecp/favicon.ico, /owa/auth/logon.aspx, /ecp/default.flt) carry an attacker-controlled X-BEResource (or X-AnonResource-Backend) cookie shaped <host>/<path>?~<n>; the CAS proxies the request to the chosen backend host on port 444 as the Exchange machine account. Chained with CVE-2021-27065 to write an .aspx web shell under an OWA/ECP virtual directory.

Public PoCyes

PoC URLs https://github.com/herwonowr/exprolog
https://github.com/alt3kx/CVE-2021-26855_PoC
https://github.com/praetorian-inc/proxylogon-exploit Third-party repos; verify before use.

Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Numerous functional public exploit chains (exprolog, SharpProxyLogon, praetorian proxylogon-exploit, alt3kx SSRF PoCs); mass-exploited by HAFNIUM and many other actors since March 2021

SummaryServer-side request forgery in the Microsoft Exchange Client Access service that lets unauthenticated attackers proxy requests to the backend as the Exchange machine account. It is the entry point of the ProxyLogon chain, paired with CVE-2021-27065 for arbitrary file writes and web shell installation. Mass-exploited in the wild since March 2021 (CISA KEV); fixed in the March 2021 Exchange security updates.

Tia coverage

First reported2026-09-17

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attack

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.