CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability

9.1 CriticalIn KEVPublic exploit

Microsoft Exchange Server Remote Code Execution Vulnerability

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

100.0%Up 12.4 points since Apr 14, 2021

What each source reports

CVE List Score used 9.1

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Record: CVE-2021-26855
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2021-13639 9.1

Microsoft Exchange Server Remote Code Execution Vulnerability

Record: EUVD-2021-13639
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6784-2mh5-cq56 9.8

Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021...

Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.

Record: GHSA-6784-2mh5-cq56
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-918
Updated: 2026-11-02

CISA KEV No score

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Record: CVE-2021-26855
Weakness: CWE-918
Updated: 2026-11-02

NVD 9.1

Microsoft Exchange Server Remote Code Execution Vulnerability

Record: CVE-2021-26855
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-918
Updated: 2026-11-02

Affected products

Show 13 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Microsoft Exchange ProxyLogon RCE	2021-03-02
PoC in GitHub	sgnls/exchange-0days-202103	2021-03-03
PoC in GitHub	soteria-security/HAFNIUM-IOC	2021-03-03
PoC in GitHub	cert-lv/exchange_webshell_detection	2021-03-05
PoC in GitHub	conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855	2021-03-06
PoC in GitHub	pussycat0x/CVE-2021-26855-SSRF	2021-03-06
PoC in GitHub	La3B0z/CVE-2021-26855-SSRF-Exchange	2021-03-07
PoC in GitHub	mekhalleh/exchange_proxylogon	2021-03-07
PoC in GitHub	Yt1g3r/CVE-2021-26855_SSRF	2021-03-08
PoC in GitHub	dwisiswant0/proxylogscan	2021-03-08

Show 23 moreShow less

Public exploits
Source	Link	Date
PoC in GitHub	hackerxj007/CVE-2021-26855	2021-03-08
PoC in GitHub	DCScoder/Exchange_IOC_Hunter	2021-03-09
PoC in GitHub	h4x0r-dz/CVE-2021-26855	2021-03-09
PoC in GitHub	mauricelambert/ExchangeWeaknessTest	2021-03-09
PoC in GitHub	srvaccount/CVE-2021-26855-PoC	2021-03-09
PoC in GitHub	alt3kx/CVE-2021-26855_PoC	2021-03-10
Exploit-DB	Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC)	2021-03-11
PoC in GitHub	SCS-Labs/HAFNIUM-Microsoft-Exchange-0day	2021-03-11
PoC in GitHub	hackerschoice/CVE-2021-26855	2021-03-11
PoC in GitHub	r0xDB/CVE-2021-26855	2021-03-11
PoC in GitHub	KotSec/CVE-2021-26855-Scanner	2021-03-12
Exploit-DB	Microsoft Exchange 2019 - Server-Side Request Forgery	2021-03-14
PoC in GitHub	ZephrFish/Exch-CVE-2021-26855	2021-03-14
PoC in GitHub	hakivvi/proxylogon	2021-03-14
PoC in GitHub	mil1200/ProxyLogon-CVE-2021-26855	2021-03-14
PoC in GitHub	Mr-xn/CVE-2021-26855-d	2021-03-15
PoC in GitHub	ZephrFish/Exch-CVE-2021-26855_Priv	2021-03-15
PoC in GitHub	evilashz/ExchangeSSRFtoRCEExploit	2021-03-15
Exploit-DB	Microsoft Exchange 2019 - Unauthenticated Email Download	2021-05-18
Exploit-DB	Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)	2021-05-21
Metasploit	Microsoft Exchange ProxyLogon Collector	2021-03-02
Metasploit	Microsoft Exchange ProxyLogon Scanner	2021-03-02
Nuclei	Microsoft Exchange Server SSRF Vulnerability

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 3, 2026	exploits, exploits_more
Nov 3, 2026	exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26855 is a critical vulnerability (CVSS 9.1) in Microsoft Exchange Server, published March 2, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

References

This page doesn't list everything

The full exploit list has 28 more links.