CVE-2021-26855

Confirmed PUBLISHED

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Exchange Server 2019 Cumulative Update 8, Microsoft Exchange Server 2019, Microsoft Exchange Server 2013 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 2, Microsoft Exchange Server 2016 Cumulative Update 13, Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 3, Microsoft Exchange Server 2016 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 4, Microsoft Exchange Server 2016 Cumulative Update 15, Microsoft Exchange Server 2019 Cumulative Update 5, Microsoft Exchange Server 2019 Cumulative Update 6, Microsoft Exchange Server 2016 Cumulative Update 16, Microsoft Exchange Server 2016 Cumulative Update 17, Microsoft Exchange Server 2019 Cumulative Update 7, Microsoft Exchange Server 2016 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 21, Microsoft Exchange Server 2016 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 8, Microsoft Exchange Server 2019 Cumulative Update 1, Microsoft Exchange Server 2016 Cumulative Update 9, Microsoft Exchange Server 2016 Cumulative Update 10, Microsoft Exchange Server 2016 Cumulative Update 11

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.1 Critical EPSS 100.0%

At a Glance

Microsoft Exchange Server Remote Code Execution Vulnerability

cisa malware nuclei_scanner ransomware microsoft metasploit

CVE Published: Mar 02, 2021
Exploitation Reported: Apr 27, 2025
CVSS: 9.1 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 19	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 8	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 22	15.00.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 2	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 13	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 23	15.00.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 3	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 14	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 4	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 15	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 5	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 6	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 16	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 17	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 7	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 18	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 21	15.00.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 12	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 8	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 1	15.02.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 9	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 10	15.01.0 to < publication	Affected
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 11	15.01.0 to < publication	Affected

CVE References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 portal.msrc.microsoft.com · CVE Record https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CV...
packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Ar... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-S...
packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-R... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyL...
packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthe... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-U...
packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-C... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyL...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
The Shadowserver	2026-06-01 00:00 UTC
Tenable Blog	2026-06-02 14:21 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26855.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxylogon_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.1 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2.0 7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation Status

Exploited in the wild

Recorded 2025-04-27 00:00:00 UTC · The Shadowserver

Used in malware

Recorded 2021-11-03 00:00:00 UTC · The Shadowserver

Proof of concept available

Recorded 2021-03-06 09:15:55 UTC · GitHub

Weaknesses (CWE)

CWE-918

Server-Side Request Forgery (SSRF)

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxylogon_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26855.yaml	Apr 25, 2025

Recent Mentions

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable Blog · May 27, 2026

Tenable Research has developed a graph-based model linking 600+ threat groups to real-world customer exposures. It reveals which vulnerabilities sit at the intersection of severity, active exploitation, and organizational risk.Key takeawaysThe "patch everything" strategy is dead: Vulnerability prioritization based on exploitation risk offers a path forward. A directed graph model linking 600+ threat actors to vulnerabilities in 7,800 customer environments reveals that 68% of organizations carry at least one CVE previously exploited by a named adversary, and 321 tracked threat groups can reach at least one customer environment through an active vulnerability. Prevalence of "Elite Arsenal" CVEs requires immediate attention: The 242 "Elite Arsenal" CVEs — those meeting all three criteria of critical VPR (≥ 9), CISA KEV listing, and documented threat group exploitation — are nearly universally present across the studied customer base, with 241 of 242 actively detected. More than half are five or more years old, and 78% of the persistently exploited core are simultaneously weaponized by nation-state APTs, commodity malware operators, and ransomware gangs. Non-CVE exposures are universally dangerous: Non-CVE exposures, including misconfigurations, weak credentials, and end-of-life software, are present in virtually 100% of studied organizations, with 60% carrying at least one that maps to a tracked threat actor's preferred techniques. Preliminary modeling suggests these exposures may confer more breach risk than CVE-linked findings, yet no industry-standard scoring infrastructure exists to prioritize them.While the first two posts in this blog series documented the accelerating vulnerability flood and the widening remediation gap, today we answer the outstanding question: Where do these forces actually collide inside customer environments? Using a directed graph model that maps more than 600 tracked threat groups to vulnerabilities observed across 7,800 organizations,...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

hictf/CVE-2021-26855-CVE-2021-27065

github · Created 2021-03-23 07:37:47 UTC · 0 stars

analytics ProxyLogo Mail exchange RCE

catmandx/CVE-2021-26855-Exchange-RCE

github · Created 2021-03-21 06:16:24 UTC · 0 stars

Microsoft Exchange Proxylogon Exploit Chain EXP分析

shacojx/CVE-2021-26855-exploit-Exchange

github · Created 2021-03-18 10:45:54 UTC · 6 stars

TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit

github · Created 2021-03-17 03:32:19 UTC · 4 stars

CVE-2021-26855 proxyLogon metasploit exploit script

shacojx/Scan-Vuln-CVE-2021-26855

github · Created 2021-03-16 15:59:17 UTC · 3 stars

Mr-xn/CVE-2021-26855-d

github · Created 2021-03-15 14:03:16 UTC · 6 stars

ZephrFish/Exch-CVE-2021-26855_Priv

github · Created 2021-03-15 12:33:04 UTC · 4 stars

patched to work

mil1200/ProxyLogon-CVE-2021-26855

github · Created 2021-03-14 22:57:21 UTC · 8 stars

RCE exploit for ProxyLogon vulnerability in Microsoft Exchange

ZephrFish/Exch-CVE-2021-26855

github · Created 2021-03-14 14:23:34 UTC · 27 stars

CVE-2021-26855: PoC (Not a HoneyPoC for once!)

KotSec/CVE-2021-26855-Scanner

github · Created 2021-03-12 12:47:41 UTC · 4 stars

Scanner and PoC for CVE-2021-26855

hackerschoice/CVE-2021-26855

github · Created 2021-03-11 20:51:48 UTC · 61 stars

PoC of proxylogon chain SSRF(CVE-2021-26855) to write file by testanull, censored by github

r0xdeadbeef/CVE-2021-26855

github · Created 2021-03-11 19:35:35 UTC · 12 stars

CVE-2021-26855, also known as Proxylogon, is a server-side request forgery (SSRF) vulnerability in Exchange that allows an attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

alt3kx/CVE-2021-26855_PoC

github · Created 2021-03-10 05:21:19 UTC · 53 stars

h4x0r-dz/CVE-2021-26855

github · Created 2021-03-09 16:54:39 UTC · 99 stars

srvaccount/CVE-2021-26855-PoC

github · Created 2021-03-09 14:27:06 UTC · 17 stars

PoC exploit code for CVE-2021-26855

hackerxj007/CVE-2021-26855

github · Created 2021-03-08 09:12:27 UTC · 5 stars

CVE-2021-26855 exp

Yt1g3r/CVE-2021-26855_SSRF

github · Created 2021-03-08 07:28:21 UTC · 4 stars

POC of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865, ProxyLogon poc

La3B0z/CVE-2021-26855-SSRF-Exchange

github · Created 2021-03-07 00:55:16 UTC · 6 stars

CVE-2021-26855 SSRF Exchange Server

pussycat0x/CVE-2021-26855-SSRF

github · Created 2021-03-06 19:03:00 UTC · 20 stars

This script helps to identify CVE-2021-26855 ssrf Poc

conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855

github · Created 2021-03-06 09:15:55 UTC · 36 stars

Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)

Microsoft Exchange Server SSRF Vulnerability

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

2 Jun 2026 14:21 UTC about 2 months ago

2 Jun 2026 14:21 UTC · about 2 months ago

KEV confirmed by Tenable Blog

Exploitation attested by an external source
1 Jun 2026 00:00 UTC about 2 months ago

1 Jun 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

First public exploitation report

Exploit observed in malware
6 Mar 2021 09:15 UTC over 5 years ago

6 Mar 2021 09:15 UTC · over 5 years ago

Public PoC available

Public proof-of-concept code published
2 Mar 2021 23:55 UTC over 5 years ago

2 Mar 2021 23:55 UTC · over 5 years ago

CVE published

Vulnerability disclosed publicly
8 Feb 2021 00:00 UTC over 5 years ago

8 Feb 2021 00:00 UTC · over 5 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-26855

{
  "cve_id": "CVE-2021-26855",
  "title": "Microsoft Exchange Server Remote Code Execution Vulnerability",
  "affected_vendor": "Microsoft",
  "affected_product": "Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Exchange Server 2019 Cumulative Update 8, Microsoft Exchange Server 2019, Microsoft Exchange Server 2013 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 2, Microsoft Exchange Server 2016 Cumulative Update 13, Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 3, Microsoft Exchange Server 2016 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 4, Microsoft Exchange Server 2016 Cumulative Update 15, Microsoft Exchange Server 2019 Cumulative Update 5, Microsoft Exchange Server 2019 Cumulative Update 6, Microsoft Exchange Server 2016 Cumulative Update 16, Microsoft Exchange Server 2016 Cumulative Update 17, Microsoft Exchange Server 2019 Cumulative Update 7, Microsoft Exchange Server 2016 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 21, Microsoft Exchange Server 2016 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 8, Microsoft Exchange Server 2019 Cumulative Update 1, Microsoft Exchange Server 2016 Cumulative Update 9, Microsoft Exchange Server 2016 Cumulative Update 10, Microsoft Exchange Server 2016 Cumulative Update 11",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.1,
  "epss_score": 0.99999,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-26855

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API