CVE-2021-27078
published 2021-03-03CVE-2021-27078: Microsoft Exchange Server Remote Code Execution Vulnerability
PriorityP260high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EXPLOIT
EPSS
18.34%
96.9th percentile
Microsoft Exchange Server Remote Code Execution Vulnerability
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | >= 0 < 4.4.0-273.307 | 4.4.0-273.307 |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | microsoft_exchange_server_2013_cumulative_update_23 | >= 15.00.0 < publication | publication |
| microsoft | microsoft_exchange_server_2016_cumulative_update_18 | >= 15.01.0 < publication | publication |
| microsoft | microsoft_exchange_server_2016_cumulative_update_19 | >= 15.01.0 < publication | publication |
| microsoft | microsoft_exchange_server_2019_cumulative_update_7 | >= 15.02.0 < publication | publication |
| microsoft | microsoft_exchange_server_2019_cumulative_update_8 | >= 15.02.0 < publication | publication |
| msrc | microsoft_exchange_server_2013_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_18 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_19 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_7 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_8 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- ·Exploit Status is Publicly Disclosed: No and Exploited: No, with exploitation rated 'Less Likely' for both latest and older software releases. No public PoC or active exploitation observed at time of advisory. ↗
- ·Affected product is Microsoft Exchange Server (Remote Code Execution). Patches are distributed via Microsoft Update/Download Center. No specific affected versions or patch file hashes are enumerated in the provided sources. ↗
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv5.5MEDIUM
vendor_msrc9.1CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-aws vulnerabilities
osv·2025-10-21·CVSS 5.5
CVE-2025-38618 linux-aws vulnerabilities
linux-aws vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Virtio block driver;
- Media drivers;
- Network drivers;
- Framebuffer layer;
- BTRFS file system;
- Ext4 file system;
- Network file system (NFS) server daemon;
- Packet sockets;
- VMware vSockets driver;
(CVE-2025-38618, CVE-2024-35849, CVE-2025-37785, CVE-2024-49924,
CVE-2025-38617, CVE-2024-27078, CVE-2021-47149, CVE-2021-47319,
CVE-2025-21796, CVE-2021-47589)
OSV
linux-aws, linux-lts-xenial vulnerabilities
osv·2025-10-02·CVSS 5.5
CVE-2024-49924 linux-aws, linux-lts-xenial vulnerabilities
linux-aws, linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Virtio block driver;
- Media drivers;
- Network drivers;
- Framebuffer layer;
- BTRFS file system;
- Ext4 file system;
- Network file system (NFS) server daemon;
- Packet sockets;
- VMware vSockets driver;
(CVE-2024-49924, CVE-2021-47149, CVE-2025-21796, CVE-2025-38617,
CVE-2021-47589, CVE-2021-47319, CVE-2024-27078, CVE-2025-38618,
CVE-2025-37785, CVE-2024-35849)
OSV
linux, linux-kvm vulnerabilities
osv·2025-10-02·CVSS 5.5
CVE-2025-38618 linux, linux-kvm vulnerabilities
linux, linux-kvm vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Virtio block driver;
- Media drivers;
- Network drivers;
- Framebuffer layer;
- BTRFS file system;
- Ext4 file system;
- Network file system (NFS) server daemon;
- Packet sockets;
- VMware vSockets driver;
(CVE-2025-38618, CVE-2024-35849, CVE-2025-37785, CVE-2024-49924,
CVE-2025-38617, CVE-2024-27078, CVE-2021-47149, CVE-2021-47319,
CVE-2025-21796, CVE-2021-47589)
GHSA
GHSA-rwm8-8c4x-v87q: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-2685
ghsa_unreviewed·2022-05-24·CVSS 9.1
CVE-2021-27065 [CRITICAL] CWE-22 GHSA-rwm8-8c4x-v87q: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-2685
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27078.
GHSA
GHSA-6784-2mh5-cq56: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-2685
ghsa_unreviewed·2022-05-24·CVSS 9.1
CVE-2021-26855 [CRITICAL] CWE-918 GHSA-6784-2mh5-cq56: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-2685
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
GHSA
GHSA-2xf7-r7hp-r5qc: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26855, CVE-2021-26857, CVE-2021-2685
ghsa_unreviewed·2022-05-24·CVSS 9.1
CVE-2021-26854 [CRITICAL] GHSA-2xf7-r7hp-r5qc: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26855, CVE-2021-26857, CVE-2021-2685
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
GHSA
GHSA-r4wp-245q-vr5w: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-2685
ghsa_unreviewed·2022-05-24·CVSS 9.1
CVE-2021-26858 [CRITICAL] GHSA-r4wp-245q-vr5w: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-2685
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-27065, CVE-2021-27078.
GHSA
Rails is bad
ghsa_unreviewed·2022-05-24·CVSS 9.1
CVE-2021-26857 [CRITICAL] CWE-502 Rails is bad
Rails is bad
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
GHSA
GHSA-xc64-jf3q-gg7j: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-2685
ghsa_unreviewed·2022-05-24·CVSS 6.6
CVE-2021-26412 [MEDIUM] GHSA-xc64-jf3q-gg7j: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-2685
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
GHSA
GHSA-5rg7-hgww-7chr: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-2685
ghsa_unreviewed·2022-05-24·CVSS 9.1
CVE-2021-27078 [CRITICAL] GHSA-5rg7-hgww-7chr: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-2685
Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065.
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2021-03-09·CVSS 9.1
CVE-2021-27078 [CRITICAL] Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server: Microsoft Exchange Server
Microsoft: Microsoft
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: http://www.microsoft.com/download/details.aspx?familyid=31211a48-0cef-462e-bb11-c36440f80bb3
Reference: https://support.microsoft.com/help/5000871
Reference: https://www.microsoft.com/download/details.aspx?familyid=18c75641-e53d-4979-8d5e-29a80674e41f
Reference: http://www.microsoft.com/download/details.aspx?familyid=1255ecd7-b187-4839-96c9-1fc5e05df7b6
Reference: http://www.microsoft.com/download/details.aspx?familyid=2aadda14-b8aa-4370-a492-0a6818facce
No detection rules found.
Nuclei
Microsoft Exchange Server SSRF Vulnerability
nuclei·CVSS 7.2
CVE-2021-26855 [HIGH] Microsoft Exchange Server SSRF Vulnerability
Microsoft Exchange Server SSRF Vulnerability
This vulnerability is part of an attack chain that could allow remote code execution on Microsoft Exchange Server. The initial attack requires the ability to make an untrusted connection to Exchange server port 443. Other portions of the chain can be triggered if an attacker already has access or can convince an administrator to open a malicious file. Be aware his CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, and CVE-2021-27078.
Template:
id: CVE-2021-26855
info:
name: Microsoft Exchange Server SSRF Vulnerability
author: madrobot
severity: critical
description: This vulnerability is part of an attack chain that could allow remote code execution on Microsoft Exchange Server. The initial
Trendmicro
March Patch Tuesday: Fixes for Exchange Server, IE
blogs_trendmicro·2021-03-10·CVSS 9.1
[CRITICAL] March Patch Tuesday: Fixes for Exchange Server, IE
# March Patch Tuesday: Fixes for Exchange Server, IE
This month’s Patch Tuesday includes fixes already released for the Microsoft Exchange Server zero-day flaws attributed to Hafnium attacks.
By: Trend Micro
2021/03/10
Read time: ( words)
Save to Folio
This month’s Patch Tuesday features close to a hundred fixes, almost doubling last month’s total. The list includes patches already released for the Microsoft Exchange Server zero-day flaws attributed to Hafnium attacks.
Out of 89 patches released, 14 were rated Critical while the rest were deemed Important. Most of the critical vulnerabilities involve remote code execution (RCE) link except for an information disclosure bug. Fifteen of these were reported by the Zero Day Initiative (ZDI).
Microsoft Exchange Server Vulnerabilities
Th
Talos
Threat Advisory: HAFNIUM and Microsoft Exchange zero-day
blogs_talos·2021-03-04·CVSS 9.1
CVE-2021-26855 [CRITICAL] Threat Advisory: HAFNIUM and Microsoft Exchange zero-day
Microsoft released patches for four vulnerabilities in Exchange Server on March 2, disclosing that these vulnerabilities were being exploited by a previously unknown threat actor, referred to as HAFNIUM.
The vulnerabilities in question — CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065 — affect Microsoft Exchange Server 2019, 2016, 2013 and the out-of-support Microsoft Exchange Server 2010. The patches for these vulnerabilities should be applied as soon as possible. Microsoft Exchange Online is not affected.
Patches for an additional three vulnerabilities in the same software have also been released: CVE-2021-26412, CVE-2021-26854 and CVE-2021-27078. It is believed that these vulnerabilities have not yet been exploited in the wild.
## Threat activity details
The threat
Talos
Threat Advisory: HAFNIUM and Microsoft Exchange zero-day
blogs_talos·2021-03-04·CVSS 9.1
CVE-2021-26855 [CRITICAL] Threat Advisory: HAFNIUM and Microsoft Exchange zero-day
## Threat Advisory: HAFNIUM and Microsoft Exchange zero-day
Microsoft released patches for four vulnerabilities in Exchange Server on March 2, disclosing that these vulnerabilities were being exploited by a previously unknown threat actor, referred to as HAFNIUM .
The vulnerabilities in question — CVE-2021-26855 , CVE-2021-26857 , CVE-2021-26858 and CVE-2021-27065 — affect Microsoft Exchange Server 2019, 2016, 2013 and the out-of-support Microsoft Exchange Server 2010. The patches for these vulnerabilities should be applied as soon as possible. Microsoft Exchange Online is not affected.
Patches for an additional three vulnerabilities in the same software have also been released: CVE-2021-26412 , CVE-2021-26854 and CVE-2021-27078 . It is believed that these vulnerabilities have not yet b
Qualys
Microsoft Exchange Server Zero-Days (ProxyLogon) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR
blogs_qualys·2021-03-03·CVSS 9.1
[CRITICAL] Microsoft Exchange Server Zero-Days (ProxyLogon) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR
## Table of Contents
CVE Technical Details
Attack Chain
Discover and Remediate the Zero-Day Vulnerabilities Using Qualys VMDR
Post-Compromise Detection Details
References
Update March 10, 2021 : A new section describes how to respond with mitigation controls if patches cannot be applied, as recommended by Microsoft. This section details the Qualys Policy Compliance control ids for each vulnerability.
Update March 8, 2021 : Qualys has released an additional QID: 50108 which remotely detects instances of Exchange Server vulnerable to ProxyLogon vulnerability CVE-2021-26855 without authentication. QID 50108 is available in VULNSIGS-2.5.125-3 version and above, and is available across all platforms as of March 8th, 1:38 AM ET. This QID is not applicable to agents, so the signature versi
Qualys
Microsoft Exchange Server Zero-Days (ProxyLogon) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR | Qualys
blogs_qualys·2021-03-03·CVSS 9.1
[CRITICAL] Microsoft Exchange Server Zero-Days (ProxyLogon) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR | Qualys
#### Table of Contents
- CVE Technical Details
- Attack Chain
- Discover and Remediate the Zero-Day Vulnerabilities Using Qualys VMDR
- Post-Compromise Detection Details
- References
Update March 10, 2021: A new section describes how to respond with mitigation controls if patches cannot be applied, as recommended by Microsoft. This section details the Qualys Policy Compliance control ids for each vulnerability.
Update March 8, 2021: Qualys has released an additional QID: 50108 which remotely detects instances of Exchange Server vulnerable to ProxyLogon vulnerability CVE-2021-26855 without authentication. QID 50108 is available in VULNSIGS-2.5.125-3 version and above, and is available across all platforms as of March 8th, 1:38 AM ET. This QID is not applicable to agents, so the signature
Tenable
CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065: Four Zero-Day Vulnerabilities in Microsoft Exchange Server Exploited in the Wild
blogs_tenable·2021-03-02·CVSS 9.1
[CRITICAL] CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065: Four Zero-Day Vulnerabilities in Microsoft Exchange Server Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Crowdstrike
March 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] March 2021 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2021-03-03
Published