CVE-2021-26858
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
- Record
CVE-2021-26858- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C - Updated
- 2026-11-02
EUVDEUVD-2021-13642
Microsoft Exchange Server Remote Code Execution Vulnerability
- Record
EUVD-2021-13642- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r4wp-245q-vr5w
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021...
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-27065, CVE-2021-27078.
- Record
GHSA-r4wp-245q-vr5w- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
CISA KEV No score
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
- Record
CVE-2021-26858- Updated
- 2026-11-02
NVD
Microsoft Exchange Server Remote Code Execution Vulnerability
- Record
CVE-2021-26858- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
Affected products
- microsoft exchange server
- microsoft exchange server 2013 cumulative update 21
- microsoft exchange server 2013 cumulative update 22
- microsoft exchange server 2013 cumulative update 23
- microsoft exchange server 2016 cumulative update 10
- microsoft exchange server 2016 cumulative update 11
- microsoft exchange server 2016 cumulative update 12
- microsoft exchange server 2016 cumulative update 13
- microsoft exchange server 2016 cumulative update 14
- microsoft exchange server 2016 cumulative update 15
- microsoft exchange server 2016 cumulative update 16
- microsoft exchange server 2016 cumulative update 17
Show 13 moreShow less
- microsoft exchange server 2016 cumulative update 18
- microsoft exchange server 2016 cumulative update 19
- microsoft exchange server 2016 cumulative update 8
- microsoft exchange server 2016 cumulative update 9
- microsoft exchange server 2019
- microsoft exchange server 2019 cumulative update 1
- microsoft exchange server 2019 cumulative update 2
- microsoft exchange server 2019 cumulative update 3
- microsoft exchange server 2019 cumulative update 4
- microsoft exchange server 2019 cumulative update 5
- microsoft exchange server 2019 cumulative update 6
- microsoft exchange server 2019 cumulative update 7
- microsoft exchange server 2019 cumulative update 8
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-26858 is a high vulnerability (CVSS 7.8) in Microsoft Exchange Server, published March 2, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 93.7%, the 99th percentile. No source names a fixed version.