⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-05-03.

CVE-2021-26857

CWE-502 — Deserialization of Untrusted DataCWE-50625 documents12 sources
Severity
7.8HIGH
EPSS
38.3%
top 2.77%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
27
Microsoft Microsoft Exchange Server 2010 Service Pack 3Microsoft Microsoft Exchange Server 2013 Cumulative Update 21Microsoft Microsoft Exchange Server 2013 Cumulative Update 22+24 more
Timeline
PublishedMar 3
KEV addedNov 3
KEV dueMay 3
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages27 packages

▶CVEListV5microsoft/microsoft_exchange_server_201915.02.0 — publication

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

5
GHSA
Rails is bad↗2022-05-24
▶
Project0
The More You Know, The More You Know You Don’t Know - Project Zero↗2022-04-01
▶
CVEList
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-03-02
▶
VulnCheck
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021
▶
Project0
Project Zero RCA: CVE-2021-26855: Microsoft Exchange Server-Side Request Forgery↗
▶

🔍Detection Rules

1
Elastic
Microsoft Exchange Server UM Spawning Suspicious Processes↗
▶

📋Vendor Advisories

2
CISA
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-11-03
▶
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-03-09
▶

🕵️Threat Intelligence

13
Talos
Quarterly Report: Incident Response trends from Spring 2021↗2021-06-10
▶
Talos
Quarterly Report: Incident Response trends from Spring 2021↗2021-06-10
▶
Unit42
Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials↗2021-04-15
▶
Unit42
Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials↗2021-04-15
▶
Tenable
Microsoft Exchange Server ProxyLogon/Hafnium Detection Report↗2021-03-18
▶
CVE-2021-26857 (HIGH CVSS 7.8) | Microsoft Exchange Server Remote Co | cvebase.io