CVE-2021-26858
Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS
7.8
High
EPSS
93.7%
p100
KEV
YES
Nov 3, 2021
Exploit Today
80
0-100
Published: Mar 3, 2021 · Last modified: Aug 19, 2026
Product
Microsoft / Exchange Server
Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Added to KEV
Nov 3, 2021
Remediate by
May 3, 2022
Known ransomware use
Yes
Summary description
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Required action
Apply updates per vendor instructions.
Notes
Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26858
Microsoft Exchange Server Remote Code Execution Vulnerability