Log in Start free

Actively exploited · Published Mar 2, 2021 · Assigned by microsoft

CVE-2021-26855Microsoft Exchange Server Remote Code Execution Vulnerability

Critical 9.1 Exploited Ransomware

In plain English

A critical-severity server-side request forgery in Microsoft Exchange Server 2013 Cumulative Update 21 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Microsoft Exchange Server Remote Code Execution Vulnerability

Affected products (as reported)

VendorProductVersions
Microsoft Microsoft Exchange Server 2013 Cumulative Update 21 15.00.0 – before 15.00.1395.012
Microsoft Microsoft Exchange Server 2013 Cumulative Update 22 15.00.0 – before 15.00.1473.006
Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 15.00.0 – before 15.00.1497.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 10 15.01.0 – before 15.01.1531.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 11 15.01.0 – before 15.01.1591.018
Microsoft Microsoft Exchange Server 2016 Cumulative Update 12 15.01.0 – before 15.01.1713.010
Microsoft Microsoft Exchange Server 2016 Cumulative Update 13 15.01.0 – before 15.01.1779.008
Microsoft Microsoft Exchange Server 2016 Cumulative Update 14 15.01.0 – before 15.01.1847.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 15 15.01.0 – before 15.01.1913.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 16 15.01.0 – before 15.01.1979.008
Microsoft Microsoft Exchange Server 2016 Cumulative Update 17 15.01.0 – before 15.01.2044.013
Microsoft Microsoft Exchange Server 2016 Cumulative Update 18 15.01.0 – before 15.01.2106.013
Microsoft Microsoft Exchange Server 2016 Cumulative Update 19 15.01.0 – before 15.01.2176.009
Microsoft Microsoft Exchange Server 2016 Cumulative Update 8 15.01.0 – before 15.01.1415.010
Microsoft Microsoft Exchange Server 2016 Cumulative Update 9 15.01.0 – before 15.01.1466.016
Microsoft Microsoft Exchange Server 2019 15.02.0 – before 15.02.0221.018
Microsoft Microsoft Exchange Server 2019 Cumulative Update 1 15.02.0 – before 15.01.1979.006
Microsoft Microsoft Exchange Server 2019 Cumulative Update 2 15.02.0 – before 15.02.0397.011
Microsoft Microsoft Exchange Server 2019 Cumulative Update 3 15.02.0 – before 15.02.0464.015
Microsoft Microsoft Exchange Server 2019 Cumulative Update 4 15.02.0 – before 15.02.0659.012
Microsoft Microsoft Exchange Server 2019 Cumulative Update 5 15.02.0 – before 15.02.0595.008
Microsoft Microsoft Exchange Server 2019 Cumulative Update 6 15.02.0 – before 15.02.0529.013
Microsoft Microsoft Exchange Server 2019 Cumulative Update 7 15.02.0 – before 15.02.0721.013
Microsoft Microsoft Exchange Server 2019 Cumulative Update 8 15.02.0 – before 15.02.0792.010

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

References