CVE-2021-26857
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
- Record
CVE-2021-26857- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2021-13641
Microsoft Exchange Server Remote Code Execution Vulnerability
- Record
EUVD-2021-13641- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2qwq-gqpm-q83g
Rails is bad
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
- Record
GHSA-2qwq-gqpm-q83g- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-502, CWE-506
- Updated
- 2026-11-02
CISA KEV No score
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
- Record
CVE-2021-26857- Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
Microsoft Exchange Server Remote Code Execution Vulnerability
- Record
CVE-2021-26857- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
- microsoft exchange server
- microsoft exchange server 2010 service pack 3
- microsoft exchange server 2013 cumulative update 21
- microsoft exchange server 2013 cumulative update 22
- microsoft exchange server 2013 cumulative update 23
- microsoft exchange server 2013 service pack 1
- microsoft exchange server 2016 cumulative update 10
- microsoft exchange server 2016 cumulative update 11
- microsoft exchange server 2016 cumulative update 12
- microsoft exchange server 2016 cumulative update 13
- microsoft exchange server 2016 cumulative update 14
- microsoft exchange server 2016 cumulative update 15
Show 15 moreShow less
- microsoft exchange server 2016 cumulative update 16
- microsoft exchange server 2016 cumulative update 17
- microsoft exchange server 2016 cumulative update 18
- microsoft exchange server 2016 cumulative update 19
- microsoft exchange server 2016 cumulative update 8
- microsoft exchange server 2016 cumulative update 9
- microsoft exchange server 2019
- microsoft exchange server 2019 cumulative update 1
- microsoft exchange server 2019 cumulative update 2
- microsoft exchange server 2019 cumulative update 3
- microsoft exchange server 2019 cumulative update 4
- microsoft exchange server 2019 cumulative update 5
- microsoft exchange server 2019 cumulative update 6
- microsoft exchange server 2019 cumulative update 7
- microsoft exchange server 2019 cumulative update 8
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | sirpedrotavares/Proxylogon-exploit | 2021-03-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-26857 is a high vulnerability (CVSS 7.8) in Microsoft Exchange Server, published March 2, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.8%, the 99th percentile. No source names a fixed version.