Back to KEVs

CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability

Basic Information

CVE State
PUBLISHED
Reserved Date
February 08, 2021
Published Date
March 02, 2021
Last Updated
October 21, 2025
Vendor
Microsoft
Product
Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Exchange Server 2019 Cumulative Update 8, Microsoft Exchange Server 2019, Microsoft Exchange Server 2013 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 2, Microsoft Exchange Server 2016 Cumulative Update 13, Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 3, Microsoft Exchange Server 2016 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 4, Microsoft Exchange Server 2016 Cumulative Update 15, Microsoft Exchange Server 2019 Cumulative Update 5, Microsoft Exchange Server 2019 Cumulative Update 6, Microsoft Exchange Server 2016 Cumulative Update 16, Microsoft Exchange Server 2016 Cumulative Update 17, Microsoft Exchange Server 2019 Cumulative Update 7, Microsoft Exchange Server 2016 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 21, Microsoft Exchange Server 2016 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 8, Microsoft Exchange Server 2019 Cumulative Update 1, Microsoft Exchange Server 2016 Cumulative Update 9, Microsoft Exchange Server 2016 Cumulative Update 10, Microsoft Exchange Server 2016 Cumulative Update 11
Description
Microsoft Exchange Server Remote Code Execution Vulnerability
Tags
cisa malware ransomware nuclei_scanner metasploit microsoft

CVSS Scores

CVSS v3.1

9.1 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C

SSVC Information

Exploitation
active
Automatable
Yes
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2025-04-27 00:00:00 UTC) Source
Used in Malware
Yes (added 2021-11-03 00:00:00 UTC) Source

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html

Known Exploited Vulnerability Information

Source Added Date
CISA 2021-11-03 00:00:00 UTC
CISA 2021-11-03 00:00:00 UTC

Recent Mentions

Tenable Research has developed a graph-based model linking 600+ threat groups to real-world customer exposures. It reveals which vulnerabilities sit at the intersection of severity, active exploitation, and organizational risk.Key takeawaysThe "patch everything" strategy is dead: Vulnerability prioritization based on exploitation risk offers a path forward. A directed graph model linking 600+ threat actors to vulnerabilities in 7,800 customer environments reveals that 68% of organizations carry at least one CVE previously exploited by a named adversary, and 321 tracked threat groups can reach at least one customer environment through an active vulnerability. Prevalence of "Elite Arsenal" CVEs requires immediate attention: The 242 "Elite Arsenal" CVEs — those meeting all three criteria of critical VPR (≥ 9), CISA KEV listing, and documented threat group exploitation — are nearly universally present across the studied customer base, with 241 of 242 actively detected. More than half are five or more years old, and 78% of the persistently exploited core are simultaneously weaponized by nation-state APTs, commodity malware operators, and ransomware gangs. Non-CVE exposures are universally dangerous: Non-CVE exposures, including misconfigurations, weak credentials, and end-of-life software, are present in virtually 100% of studied organizations, with 60% carrying at least one that maps to a tracked threat actor's preferred techniques. Preliminary modeling suggests these exposures may confer more breach risk than CVE-linked findings, yet no industry-standard scoring infrastructure exists to prioritize them.While the first two posts in this blog series documented the accelerating vulnerability flood and the widening remediation gap, today we answer the outstanding question: Where do these forces actually collide inside customer environments? Using a directed graph model that maps more than 600 tracked threat groups to vulnerabilities observed across 7,800 organizations,...

Scanner Integrations

Scanner URL Date Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxylogon_rce.rb 2025-04-28 15:02:52 UTC
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26855.yaml 2025-04-25 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

hictf/CVE-2021-26855-CVE-2021-27065

Type: github • Created: 2021-03-23 07:37:47 UTC • Stars: 0

analytics ProxyLogo Mail exchange RCE

catmandx/CVE-2021-26855-Exchange-RCE

Type: github • Created: 2021-03-21 06:16:24 UTC • Stars: 0

Microsoft Exchange Proxylogon Exploit Chain EXP分析

shacojx/CVE-2021-26855-exploit-Exchange

Type: github • Created: 2021-03-18 10:45:54 UTC • Stars: 6

TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit

Type: github • Created: 2021-03-17 03:32:19 UTC • Stars: 4

CVE-2021-26855 proxyLogon metasploit exploit script

shacojx/Scan-Vuln-CVE-2021-26855

Type: github • Created: 2021-03-16 15:59:17 UTC • Stars: 3

Mr-xn/CVE-2021-26855-d

Type: github • Created: 2021-03-15 14:03:16 UTC • Stars: 6

ZephrFish/Exch-CVE-2021-26855_Priv

Type: github • Created: 2021-03-15 12:33:04 UTC • Stars: 4

patched to work

mil1200/ProxyLogon-CVE-2021-26855

Type: github • Created: 2021-03-14 22:57:21 UTC • Stars: 8

RCE exploit for ProxyLogon vulnerability in Microsoft Exchange

ZephrFish/Exch-CVE-2021-26855

Type: github • Created: 2021-03-14 14:23:34 UTC • Stars: 27

CVE-2021-26855: PoC (Not a HoneyPoC for once!)

KotSec/CVE-2021-26855-Scanner

Type: github • Created: 2021-03-12 12:47:41 UTC • Stars: 4

Scanner and PoC for CVE-2021-26855

hackerschoice/CVE-2021-26855

Type: github • Created: 2021-03-11 20:51:48 UTC • Stars: 61

PoC of proxylogon chain SSRF(CVE-2021-26855) to write file by testanull, censored by github

r0xdeadbeef/CVE-2021-26855

Type: github • Created: 2021-03-11 19:35:35 UTC • Stars: 12

CVE-2021-26855, also known as Proxylogon, is a server-side request forgery (SSRF) vulnerability in Exchange that allows an attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

alt3kx/CVE-2021-26855_PoC

Type: github • Created: 2021-03-10 05:21:19 UTC • Stars: 53

h4x0r-dz/CVE-2021-26855

Type: github • Created: 2021-03-09 16:54:39 UTC • Stars: 99

srvaccount/CVE-2021-26855-PoC

Type: github • Created: 2021-03-09 14:27:06 UTC • Stars: 17

PoC exploit code for CVE-2021-26855

hackerxj007/CVE-2021-26855

Type: github • Created: 2021-03-08 09:12:27 UTC • Stars: 5

CVE-2021-26855 exp

Yt1g3r/CVE-2021-26855_SSRF

Type: github • Created: 2021-03-08 07:28:21 UTC • Stars: 4

POC of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865, ProxyLogon poc

La3B0z/CVE-2021-26855-SSRF-Exchange

Type: github • Created: 2021-03-07 00:55:16 UTC • Stars: 6

CVE-2021-26855 SSRF Exchange Server

pussycat0x/CVE-2021-26855-SSRF

Type: github • Created: 2021-03-06 19:03:00 UTC • Stars: 20

This script helps to identify CVE-2021-26855 ssrf Poc

conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855

Type: github • Created: 2021-03-06 09:15:55 UTC • Stars: 36

Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Exploit Used in Malware

  • Added to KEVIntel

  • Added to KEVIntel

  • Detected by Nuclei

  • Detected by Metasploit