⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-05-03.

CVE-2021-27065

CWE-22 — Path TraversalCWE-3932 documents15 sources
Severity
7.8HIGH
EPSS
94.3%
top 0.06%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
26
Microsoft Microsoft Exchange Server 2013 Cumulative Update 21Microsoft Microsoft Exchange Server 2013 Cumulative Update 22Microsoft Microsoft Exchange Server 2013 Cumulative Update 23+23 more
Timeline
PublishedMar 3
KEV addedNov 3
KEV dueMay 3
Latest updateMay 24
CISA Required Action: Apply updates per vendor instructions.

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages26 packages

▶CVEListV5microsoft/microsoft_exchange_server_201915.02.0 — publication

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-rwm8-8c4x-v87q: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-2685↗2022-05-24
▶
Project0
The More You Know, The More You Know You Don’t Know - Project Zero↗2022-04-01
▶
CVEList
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-03-02
▶
VulnCheck
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021
▶
Project0
Project Zero RCA: CVE-2021-26855: Microsoft Exchange Server-Side Request Forgery↗
▶

💥Exploits & PoCs

3
Exploit-DB
Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC)↗2021-03-11
▶
Metasploit
Microsoft Exchange ProxyLogon Scanner↗
▶
Metasploit
Microsoft Exchange ProxyLogon RCE↗
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT Possible Microsoft Exchange ProxyLogon Activity - OABVirtualDirectory SetObject (CVE-2021-27065)↗2021-08-20
▶

📋Vendor Advisories

2
CISA
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-11-03
▶
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability↗2021-03-09
▶

🕵️Threat Intelligence

14
Securelist
Black Kingdom ransomware↗2021-06-17
▶
Talos
Quarterly Report: Incident Response trends from Spring 2021↗2021-06-10
▶
Talos
Quarterly Report: Incident Response trends from Spring 2021↗2021-06-10
▶
Unit42
Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials↗2021-04-15
▶
Unit42
Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials↗2021-04-15
▶