{"id":"CVE-2021-26855","aliases":["EUVD-2021-13639","GHSA-6784-2mh5-cq56"],"status":"published","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","description":"Microsoft Exchange Server Remote Code Execution Vulnerability","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.99996,"percentile":0.99988,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-918"],"published":"2021-03-02T23:55:26Z","modified":"2026-08-19T19:22:24Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/windows/http/exchange_proxylogon_rce","title":"Microsoft Exchange ProxyLogon RCE","type":"exploit","platform":"Windows","date":"2021-03-02","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/exchange_proxylogon_rce"},{"source":"pocgithub","id":"sgnls/exchange-0days-202103","title":"sgnls/exchange-0days-202103","date":"2021-03-03","url":"https://github.com/sgnls/exchange-0days-202103"},{"source":"pocgithub","id":"soteria-security/HAFNIUM-IOC","title":"soteria-security/HAFNIUM-IOC","date":"2021-03-03","url":"https://github.com/soteria-security/HAFNIUM-IOC"},{"source":"pocgithub","id":"cert-lv/exchange_webshell_detection","title":"cert-lv/exchange_webshell_detection","date":"2021-03-05","url":"https://github.com/cert-lv/exchange_webshell_detection"},{"source":"pocgithub","id":"conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855","title":"conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855","date":"2021-03-06","url":"https://github.com/conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855"},{"source":"pocgithub","id":"pussycat0x/CVE-2021-26855-SSRF","title":"pussycat0x/CVE-2021-26855-SSRF","date":"2021-03-06","url":"https://github.com/pussycat0x/CVE-2021-26855-SSRF"},{"source":"pocgithub","id":"La3B0z/CVE-2021-26855-SSRF-Exchange","title":"La3B0z/CVE-2021-26855-SSRF-Exchange","date":"2021-03-07","url":"https://github.com/La3B0z/CVE-2021-26855-SSRF-Exchange"},{"source":"pocgithub","id":"mekhalleh/exchange_proxylogon","title":"mekhalleh/exchange_proxylogon","date":"2021-03-07","url":"https://github.com/mekhalleh/exchange_proxylogon"},{"source":"pocgithub","id":"Yt1g3r/CVE-2021-26855_SSRF","title":"Yt1g3r/CVE-2021-26855_SSRF","date":"2021-03-08","url":"https://github.com/Yt1g3r/CVE-2021-26855_SSRF"},{"source":"pocgithub","id":"dwisiswant0/proxylogscan","title":"dwisiswant0/proxylogscan","date":"2021-03-08","url":"https://github.com/dwisiswant0/proxylogscan"},{"source":"pocgithub","id":"hackerxj007/CVE-2021-26855","title":"hackerxj007/CVE-2021-26855","date":"2021-03-08","url":"https://github.com/hackerxj007/CVE-2021-26855"},{"source":"pocgithub","id":"DCScoder/Exchange_IOC_Hunter","title":"DCScoder/Exchange_IOC_Hunter","date":"2021-03-09","url":"https://github.com/DCScoder/Exchange_IOC_Hunter"},{"source":"pocgithub","id":"h4x0r-dz/CVE-2021-26855","title":"h4x0r-dz/CVE-2021-26855","date":"2021-03-09","url":"https://github.com/h4x0r-dz/CVE-2021-26855"},{"source":"pocgithub","id":"mauricelambert/ExchangeWeaknessTest","title":"mauricelambert/ExchangeWeaknessTest","date":"2021-03-09","url":"https://github.com/mauricelambert/ExchangeWeaknessTest"},{"source":"pocgithub","id":"srvaccount/CVE-2021-26855-PoC","title":"srvaccount/CVE-2021-26855-PoC","date":"2021-03-09","url":"https://github.com/srvaccount/CVE-2021-26855-PoC"},{"source":"pocgithub","id":"alt3kx/CVE-2021-26855_PoC","title":"alt3kx/CVE-2021-26855_PoC","date":"2021-03-10","url":"https://github.com/alt3kx/CVE-2021-26855_PoC"},{"source":"exploitdb","id":"EDB-49637","title":"Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC)","type":"webapps","platform":"windows","date":"2021-03-11","url":"https://www.exploit-db.com/exploits/49637"},{"source":"pocgithub","id":"SCS-Labs/HAFNIUM-Microsoft-Exchange-0day","title":"SCS-Labs/HAFNIUM-Microsoft-Exchange-0day","date":"2021-03-11","url":"https://github.com/SCS-Labs/HAFNIUM-Microsoft-Exchange-0day"},{"source":"pocgithub","id":"hackerschoice/CVE-2021-26855","title":"hackerschoice/CVE-2021-26855","date":"2021-03-11","url":"https://github.com/hackerschoice/CVE-2021-26855"},{"source":"pocgithub","id":"r0xDB/CVE-2021-26855","title":"r0xDB/CVE-2021-26855","date":"2021-03-11","url":"https://github.com/r0xDB/CVE-2021-26855"},{"source":"pocgithub","id":"KotSec/CVE-2021-26855-Scanner","title":"KotSec/CVE-2021-26855-Scanner","date":"2021-03-12","url":"https://github.com/KotSec/CVE-2021-26855-Scanner"},{"source":"exploitdb","id":"EDB-49663","title":"Microsoft Exchange 2019 - Server-Side Request Forgery","type":"remote","platform":"windows","date":"2021-03-14","url":"https://www.exploit-db.com/exploits/49663"},{"source":"pocgithub","id":"ZephrFish/Exch-CVE-2021-26855","title":"ZephrFish/Exch-CVE-2021-26855","date":"2021-03-14","url":"https://github.com/ZephrFish/Exch-CVE-2021-26855"},{"source":"pocgithub","id":"hakivvi/proxylogon","title":"hakivvi/proxylogon","date":"2021-03-14","url":"https://github.com/hakivvi/proxylogon"},{"source":"pocgithub","id":"mil1200/ProxyLogon-CVE-2021-26855","title":"mil1200/ProxyLogon-CVE-2021-26855","date":"2021-03-14","url":"https://github.com/mil1200/ProxyLogon-CVE-2021-26855"},{"source":"pocgithub","id":"Mr-xn/CVE-2021-26855-d","title":"Mr-xn/CVE-2021-26855-d","date":"2021-03-15","url":"https://github.com/Mr-xn/CVE-2021-26855-d"},{"source":"pocgithub","id":"ZephrFish/Exch-CVE-2021-26855_Priv","title":"ZephrFish/Exch-CVE-2021-26855_Priv","date":"2021-03-15","url":"https://github.com/ZephrFish/Exch-CVE-2021-26855_Priv"},{"source":"pocgithub","id":"evilashz/ExchangeSSRFtoRCEExploit","title":"evilashz/ExchangeSSRFtoRCEExploit","date":"2021-03-15","url":"https://github.com/evilashz/ExchangeSSRFtoRCEExploit"},{"source":"exploitdb","id":"EDB-49879","title":"Microsoft Exchange 2019 - Unauthenticated Email Download","type":"webapps","platform":"windows","date":"2021-05-18","url":"https://www.exploit-db.com/exploits/49879"},{"source":"exploitdb","id":"EDB-49895","title":"Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)","type":"webapps","platform":"windows","date":"2021-05-21","url":"https://www.exploit-db.com/exploits/49895"},{"source":"metasploit","id":"auxiliary/gather/exchange_proxylogon_collector","title":"Microsoft Exchange ProxyLogon Collector","type":"auxiliary","date":"2021-03-02","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/exchange_proxylogon_collector"},{"source":"metasploit","id":"auxiliary/scanner/http/exchange_proxylogon","title":"Microsoft Exchange ProxyLogon Scanner","type":"auxiliary","date":"2021-03-02","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/exchange_proxylogon"},{"source":"nuclei","id":"CVE-2021-26855","title":"Microsoft Exchange Server SSRF Vulnerability","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26855.yaml"}],"exploits_more":28,"products":[{"vendor":"microsoft","product":"exchange server"},{"vendor":"microsoft","product":"exchange_server"},{"vendor":"microsoft","product":"microsoft exchange server 2013 cumulative update 21"},{"vendor":"microsoft","product":"microsoft exchange server 2013 cumulative update 22"},{"vendor":"microsoft","product":"microsoft exchange server 2013 cumulative update 23"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 10"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 11"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 12"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 13"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 14"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 15"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 16"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 17"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 18"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 19"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 8"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 9"},{"vendor":"microsoft","product":"microsoft exchange server 2019"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 1"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 2"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 3"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 4"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 5"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 6"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 7"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 8"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855","tags":["vendor-advisory","patch","Patch","Vendor Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26855"},{"url":"https://github.com/advisories/GHSA-6784-2mh5-cq56"}],"sources":{"cve":[{"id":"CVE-2021-26855","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","description":"Microsoft Exchange Server Remote Code Execution Vulnerability","status":"published","published":"2021-03-02T23:55:26Z","modified":"2026-08-19T16:30:15.282Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-13639","description":"Microsoft Exchange Server Remote Code Execution Vulnerability","status":"published","published":"2021-03-02T23:55:26Z","modified":"2026-08-19T16:30:15Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T18:01:42.811156Z"}],"ghsa":[{"id":"GHSA-6784-2mh5-cq56","title":"Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021...","description":"Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.","status":"published","published":"2022-05-24T17:43:35Z","modified":"2026-08-19T18:32:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:10:42.300371Z"}],"kev":[{"id":"CVE-2021-26855","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","description":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","cwes":["CWE-918"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2021-26855","description":"Microsoft Exchange Server Remote Code Execution Vulnerability","status":"published","published":"2021-03-03T00:15:12.103Z","modified":"2026-08-19T19:22:24.1Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:06:50.399901Z"}]}}