⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-05-03.

CVE-2021-26855

CWE-918 — Server-Side Request Forgery (SSRF)41 documents17 sources
Severity
9.8CRITICAL
EPSS
94.0%
top 0.11%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
25
Microsoft Microsoft Exchange Server 2013 Cumulative Update 21Microsoft Microsoft Exchange Server 2013 Cumulative Update 22Microsoft Microsoft Exchange Server 2013 Cumulative Update 23+22 more
Timeline
PublishedMar 3
KEV addedNov 3
KEV dueMay 3
Latest updateJun 28
CISA Required Action: Apply updates per vendor instructions.

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages25 packages

▶CVEListV5microsoft/microsoft_exchange_server_201915.02.0 — publication

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-6784-2mh5-cq56: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-2685↗2022-05-24
▶
Project0
The More You Know, The More You Know You Don’t Know - Project Zero↗2022-04-01
▶
CVEList
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-03-02
▶
VulnCheck
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021
▶
Project0
Project Zero RCA: CVE-2021-26855: Microsoft Exchange Server-Side Request Forgery↗
▶

💥Exploits & PoCs

8
Exploit-DB
Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)↗2021-05-21
▶
Exploit-DB
Microsoft Exchange 2019 - Unauthenticated Email Download↗2021-05-18
▶
Exploit-DB
Microsoft Exchange 2019 - Server-Side Request Forgery↗2021-03-14
▶
Exploit-DB
Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC)↗2021-03-11
▶
Metasploit
Microsoft Exchange ProxyLogon Scanner↗
▶

📋Vendor Advisories

2
CISA
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-11-03
▶
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-03-09
▶

🕵️Threat Intelligence

20
Unit42
Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor↗2023-06-28
▶
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report↗2022-07-21
▶
Talos
Quarterly Report: Incident Response trends from Spring 2021↗2021-06-10
▶
Talos
Quarterly Report: Incident Response trends from Spring 2021↗2021-06-10
▶
Unit42
Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials↗2021-04-15
▶

💬Community

2
HackerOne
SSRF due to CVE-2021-26855 on ████████↗2021-03-24
▶
HackerOne
CVE-2021-26855 on ████████ resulting in SSRF↗2021-03-24
▶