Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2021-26855— Microsoft Exchange Server Remote Code Execution Vulnerability

Quick assessment

Affected

Microsoft Microsoft Exchange Server 2013 Cumulative Update 21

Exploitation

Confirmed exploitation in the wild; remediate immediately

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Microsoft Exchange Server是美国微软（Microsoft）公司的一套电子邮件服务程序。它提供邮件存取、储存、转发，语音邮件，邮件过滤筛选等功能。 Microsoft Exchange Server 安全漏洞。攻击者可构造恶意HTTP请求，并通过Exchange Server进行身份验证。进而扫描内网，获取用户敏感信息。以下产品和版本受到影响：Microsoft Exchange Server 2013 Cumulative Update 23,Microsoft Exchange

CVSS 9.1 · Critical KEV · Ransomware EPSS 100.00% · P100 Updated Aug 20, 2026

Public Exploits 8

ExploitDB · 4 EDB-49663 [remote] EDB-49637#CVE-2021-26855 [webapps] EDB-49879 [webapps] EDB-49895 [webapps]

Metasploit · 3 exchange_proxylogon_rce.rb#CVE-2021-26855 [exploit] exchange_proxylogon.rb [auxiliary] exchange_proxylogon_collector.rb [auxiliary]

Nuclei · 1 CVE-2021-26855.yaml [template]

In-the-Wild Activity Observed cisa_kev · confirmed

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 24

Vendor	Product	Version Range	Status
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 21	`15.00.0< 15.00.1395.012`	affected
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 22	`15.00.0< 15.00.1473.006`	affected
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 23	`15.00.0< 15.00.1497.012`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 10	`15.01.0< 15.01.1531.012`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 11	`15.01.0< 15.01.1591.018`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 12	`15.01.0< 15.01.1713.010`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 13	`15.01.0< 15.01.1779.008`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 14	`15.01.0< 15.01.1847.012`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 15	`15.01.0< 15.01.1913.012`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 16	`15.01.0< 15.01.1979.008`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 17	`15.01.0< 15.01.2044.013`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 18	`15.01.0< 15.01.2106.013`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 19	`15.01.0< 15.01.2176.009`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 8	`15.01.0< 15.01.1415.010`	affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 9	`15.01.0< 15.01.1466.016`	affected
Microsoft	Microsoft Exchange Server 2019	`15.02.0< 15.02.0221.018`	affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 1	`15.02.0< 15.01.1979.006`	affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 2	`15.02.0< 15.02.0397.011`	affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 3	`15.02.0< 15.02.0464.015`	affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 4	`15.02.0< 15.02.0659.012`	affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 5	`15.02.0< 15.02.0595.008`	affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 6	`15.02.0< 15.02.0529.013`	affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 7	`15.02.0< 15.02.0721.013`	affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 8	`15.02.0< 15.02.0792.010`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-26855

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Microsoft Exchange Server Remote Code Execution Vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Microsoft Exchange Server 代码问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor	Product	Affected Versions	CPE
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 21	15.00.0 ~ 15.00.1395.012	-
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 22	15.00.0 ~ 15.00.1473.006	-
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 23	15.00.0 ~ 15.00.1497.012	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 10	15.01.0 ~ 15.01.1531.012	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 11	15.01.0 ~ 15.01.1591.018	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 12	15.01.0 ~ 15.01.1713.010	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 13	15.01.0 ~ 15.01.1779.008	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 14	15.01.0 ~ 15.01.1847.012	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 15	15.01.0 ~ 15.01.1913.012	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 16	15.01.0 ~ 15.01.1979.008	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 17	15.01.0 ~ 15.01.2044.013	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 18	15.01.0 ~ 15.01.2106.013	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 19	15.01.0 ~ 15.01.2176.009	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 8	15.01.0 ~ 15.01.1415.010	-
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 9	15.01.0 ~ 15.01.1466.016	-
Microsoft	Microsoft Exchange Server 2019	15.02.0 ~ 15.02.0221.018	-
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 1	15.02.0 ~ 15.01.1979.006	-
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 2	15.02.0 ~ 15.02.0397.011	-
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 3	15.02.0 ~ 15.02.0464.015	-
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 4	15.02.0 ~ 15.02.0659.012	-
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 5	15.02.0 ~ 15.02.0595.008	-
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 6	15.02.0 ~ 15.02.0529.013	-
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 7	15.02.0 ~ 15.02.0721.013	-
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 8	15.02.0 ~ 15.02.0792.010	-

II. Public POCs for CVE-2021-26855

#	POC Description	Source Link	Shenlong Link
1	IoC determination for exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.	https://github.com/sgnls/exchange-0days-202103	POC Details
2	A PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865	https://github.com/soteria-security/HAFNIUM-IOC	POC Details
3	Detect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)	https://github.com/cert-lv/exchange_webshell_detection	POC Details
4	Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)	https://github.com/conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855	POC Details
5	This script helps to identify CVE-2021-26855 ssrf Poc	https://github.com/pussycat0x/CVE-2021-26855-SSRF	POC Details
6	CVE-2021-26855 SSRF Exchange Server	https://github.com/La3B0z/CVE-2021-26855-SSRF-Exchange	POC Details
7	Module pack for #ProxyLogon (part. of my contribute for Metasploit-Framework) [CVE-2021-26855 && CVE-2021-27065]	https://github.com/mekhalleh/exchange_proxylogon	POC Details
8	POC of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865, ProxyLogon poc	https://github.com/Yt1g3r/CVE-2021-26855_SSRF	POC Details
9	CVE-2021-26855 exp	https://github.com/hackerxj007/CVE-2021-26855	POC Details
10	A fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin (CVE-2021-26855).	https://github.com/dwisiswant0/proxylogscan	POC Details
11	This script test the CVE-2021-26855 vulnerability on Exchange Server.	https://github.com/mauricelambert/ExchangeWeaknessTest	POC Details
12	CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065	https://github.com/DCScoder/Exchange_IOC_Hunter	POC Details
13	PoC exploit code for CVE-2021-26855	https://github.com/srvaccount/CVE-2021-26855-PoC	POC Details
14	None	https://github.com/h4x0r-dz/CVE-2021-26855	POC Details
15	None	https://github.com/alt3kx/CVE-2021-26855_PoC	POC Details
16	CVE-2021-26855, also known as Proxylogon, is a server-side request forgery (SSRF) vulnerability in Exchange that allows an attacker to send arbitrary HTTP requests and authenticate as the Exchange server.	https://github.com/raheel0x01/CVE-2021-26855	POC Details
17	PoC of proxylogon chain SSRF(CVE-2021-26855) to write file by testanull, censored by github	https://github.com/hackerschoice/CVE-2021-26855	POC Details
18	CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065	https://github.com/SCS-Labs/HAFNIUM-Microsoft-Exchange-0day	POC Details
19	Scanner and PoC for CVE-2021-26855	https://github.com/KotSec/CVE-2021-26855-Scanner	POC Details
20	RCE exploit for Microsoft Exchange Server (CVE-2021-26855).	https://github.com/hakivvi/proxylogon	POC Details
21	CVE-2021-26855: PoC (Not a HoneyPoC for once!)	https://github.com/ZephrFish/Exch-CVE-2021-26855	POC Details
22	RCE exploit for ProxyLogon vulnerability in Microsoft Exchange	https://github.com/mil1200/ProxyLogon-CVE-2021-26855	POC Details
23	CVE-2021-26855 & CVE-2021-27065	https://github.com/evilashz/ExchangeSSRFtoRCEExploit	POC Details
24	patched to work	https://github.com/ZephrFish/Exch-CVE-2021-26855_Priv	POC Details
25	None	https://github.com/Mr-xn/CVE-2021-26855-d	POC Details
26	ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability, CVE-2021-27065, to get code execution.	https://github.com/RickGeex/ProxyLogon	POC Details
27	Chaining CVE-2021-26855 and CVE-2021-26857 to exploit Microsoft Exchange	https://github.com/Immersive-Labs-Sec/ProxyLogon	POC Details
28	None	https://github.com/shacojx/Scan-Vuln-CVE-2021-26855	POC Details
29	CVE-2021-26855 proxyLogon metasploit exploit script	https://github.com/TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit	POC Details
30	ProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE(SSRF->GetWebShell)	https://github.com/p0wershe11/ProxyLogon	POC Details

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2021-26855

请登录查看更多情报信息。

Vendor Advisories for CVE-2021-26855 (2)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 x_refsource_MISC
🔗 CVE-2021-26855 - Security Update Guide - Microsoft - Microsoft Exchange Server Remote Code Execution Vulnerability vendor-advisory patch

Exploits & Public PoCs for CVE-2021-26855 (4)

http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html x_refsource_MISC
http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html x_refsource_MISC
http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html x_refsource_MISC
http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2021-26855

Same Patch Batch · Microsoft · 2021-03-02 · 7 CVEs total

CVE-2021-27078	9.1 CRITICAL	Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26412	9.1 CRITICAL	Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27065	7.8 HIGH	Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26858	7.8 HIGH	Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26857	7.8 HIGH	Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26854	6.6 MEDIUM	Microsoft Exchange Server Remote Code Execution Vulnerability

IV. Related Vulnerabilities

Same product: Microsoft Exchange Server 2013 Cumulative Update 21

Same vendor: Microsoft

V. Comments for CVE-2021-26855

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2021-26855— Microsoft Exchange Server Remote Code Execution Vulnerability

Quick assessment

Public Exploits 8

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 24

I. Basic Information for CVE-2021-26855

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Shenlong Deep Dive — AI Deep Analysis

Affected Products

II. Public POCs for CVE-2021-26855

III. Intelligence Information for CVE-2021-26855

Vendor Advisories for CVE-2021-26855 (2)

Exploits & Public PoCs for CVE-2021-26855 (4)

Same Patch Batch · Microsoft · 2021-03-02 · 7 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2021-26855

Leave a comment