CriticalCVE-2021-26855

    Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855)

    Published Last modified In CISA KEV since Sources: SingCERT, CVE.org

    Share

    What is affected, what to do

    Microsoft Exchange Server Remote Code Execution Vulnerability

    The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Microsoft Exchange Server 2013 Cumulative Update 21 to version 15.00.1395.012, Microsoft Exchange Server 2013 Cumulative Update 22 to version 15.00.1473.006, Microsoft Exchange Server 2013 Cumulative Update 23 to version 15.00.1497.012. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Microsoft Exchange Server 2013 Cumulative Update 21 lt 15.00.0..15.00.1395.012
    • Microsoft Exchange Server 2013 Cumulative Update 22 lt 15.00.0..15.00.1473.006
    • Microsoft Exchange Server 2013 Cumulative Update 23 lt 15.00.0..15.00.1497.012
    • Microsoft Exchange Server 2016 Cumulative Update 10 lt 15.01.0..15.01.1531.012
    • Microsoft Exchange Server 2016 Cumulative Update 11 lt 15.01.0..15.01.1591.018
    • Microsoft Exchange Server 2016 Cumulative Update 12 lt 15.01.0..15.01.1713.010
    • Microsoft Exchange Server 2016 Cumulative Update 13 lt 15.01.0..15.01.1779.008
    • Microsoft Exchange Server 2016 Cumulative Update 14 lt 15.01.0..15.01.1847.012
    • Microsoft Exchange Server 2016 Cumulative Update 15 lt 15.01.0..15.01.1913.012
    • Microsoft Exchange Server 2016 Cumulative Update 16 lt 15.01.0..15.01.1979.008
    • Microsoft Exchange Server 2016 Cumulative Update 17 lt 15.01.0..15.01.2044.013
    • Microsoft Exchange Server 2016 Cumulative Update 18 lt 15.01.0..15.01.2106.013
    • Microsoft Exchange Server 2016 Cumulative Update 19 lt 15.01.0..15.01.2176.009
    • Microsoft Exchange Server 2016 Cumulative Update 8 lt 15.01.0..15.01.1415.010
    • Microsoft Exchange Server 2016 Cumulative Update 9 lt 15.01.0..15.01.1466.016
    • Microsoft Exchange Server 2019 lt 15.02.0..15.02.0221.018
    • Microsoft Exchange Server 2019 Cumulative Update 1 lt 15.02.0..15.01.1979.006
    • Microsoft Exchange Server 2019 Cumulative Update 2 lt 15.02.0..15.02.0397.011
    • Microsoft Exchange Server 2019 Cumulative Update 3 lt 15.02.0..15.02.0464.015
    • Microsoft Exchange Server 2019 Cumulative Update 4 lt 15.02.0..15.02.0659.012
    • Microsoft Exchange Server 2019 Cumulative Update 5 lt 15.02.0..15.02.0595.008
    • Microsoft Exchange Server 2019 Cumulative Update 6 lt 15.02.0..15.02.0529.013
    • Microsoft Exchange Server 2019 Cumulative Update 7 lt 15.02.0..15.02.0721.013
    • Microsoft Exchange Server 2019 Cumulative Update 8 lt 15.02.0..15.02.0792.010
    Fixed in
    • Microsoft Exchange Server 2013 Cumulative Update 21 15.00.1395.012
    • Microsoft Exchange Server 2013 Cumulative Update 22 15.00.1473.006
    • Microsoft Exchange Server 2013 Cumulative Update 23 15.00.1497.012
    • Microsoft Exchange Server 2016 Cumulative Update 10 15.01.1531.012
    • Microsoft Exchange Server 2016 Cumulative Update 11 15.01.1591.018
    • Microsoft Exchange Server 2016 Cumulative Update 12 15.01.1713.010
    • Microsoft Exchange Server 2016 Cumulative Update 13 15.01.1779.008
    • Microsoft Exchange Server 2016 Cumulative Update 14 15.01.1847.012
    • Microsoft Exchange Server 2016 Cumulative Update 15 15.01.1913.012
    • Microsoft Exchange Server 2016 Cumulative Update 16 15.01.1979.008
    • Microsoft Exchange Server 2016 Cumulative Update 17 15.01.2044.013
    • Microsoft Exchange Server 2016 Cumulative Update 18 15.01.2106.013
    • Microsoft Exchange Server 2016 Cumulative Update 19 15.01.2176.009
    • Microsoft Exchange Server 2016 Cumulative Update 8 15.01.1415.010
    • Microsoft Exchange Server 2016 Cumulative Update 9 15.01.1466.016
    • Microsoft Exchange Server 2019 15.02.0221.018
    • Microsoft Exchange Server 2019 Cumulative Update 1 15.01.1979.006
    • Microsoft Exchange Server 2019 Cumulative Update 2 15.02.0397.011
    • Microsoft Exchange Server 2019 Cumulative Update 3 15.02.0464.015
    • Microsoft Exchange Server 2019 Cumulative Update 4 15.02.0659.012
    • Microsoft Exchange Server 2019 Cumulative Update 5 15.02.0595.008
    • Microsoft Exchange Server 2019 Cumulative Update 6 15.02.0529.013
    • Microsoft Exchange Server 2019 Cumulative Update 7 15.02.0721.013
    • Microsoft Exchange Server 2019 Cumulative Update 8 15.02.0792.010

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    9.1

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    9.1

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: SingCERT, CVE.org

    —

    EPSS score

    No value is available for this vulnerability.

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    250.48 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: ANSSI / CERT-FR, CSA/SingCERT How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    9.1 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    9.1
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.99
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 1 March 2021
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-918

    Response and mitigation

    Why act now?

    Prioritisation rationale

    CVE-2021-26855 is the entry point of the ProxyLogon chain: an unauthenticated, network-reachable server-side request forgery that, chained with CVE-2021-27065, yields SYSTEM-level code execution on Exchange. Since 2021 it has been mass-exploited by automated tooling to drop webshells, harvest mailboxes and stage ransomware, and CISA explicitly flags ransomware use. It sits among the CVEs with the very highest exploitation likelihood. Any still-exposed, unpatched on-prem Exchange server is a P1 and should be investigated as already breached. Only internal-only, fully patched servers can drop to a routine compromise-assessment check.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Scope the exposure: Identify every on-premises Exchange server (2013/2016/2019) reachable from the internet on TCP 443. Exchange Online is not affected. Treat any exposed, unpatched server as compromised, not merely vulnerable.
      • Patch: Install Microsoft's ProxyLogon security updates (March 2021) on a supported Cumulative Update, or preferably move straight to the current CU plus the latest SU. The patch is available from the vendor; look up the exact version in the vendor advisory. Verify the result with the Microsoft Exchange Health Checker.
      • Assess compromise before the server goes back online: Run Test-ProxyLogon.ps1 from Microsoft CSS-Exchange, then a full Microsoft Safety Scanner (MSERT) or EDR scan. Patching does not remove webshells that are already in place.
      • Stopgap if you cannot patch now: Run the Exchange On-premises Mitigation Tool (EOMT). It deploys the IIS URL Rewrite rule that blocks the SSRF and launches an MSERT scan. Alternatively, pull the server off the internet and allow OWA/ECP over VPN only.
      • If you find indicators: Network-isolate the host and preserve memory plus the IIS and HttpProxy logs. Reset every credential used on the box, including admin accounts and service accounts. Check whether the Exchange groups hold DCSync rights on the domain.
      • Check reporting obligations: For a confirmed compromise, the NIS2 early-warning deadline applies (within 24 h).

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: Publish OWA, ECP, EWS and Autodiscover only through a reverse proxy or VPN, and never expose /ecp to the internet. Restrict egress from the Exchange servers to an allowlist so that webshell callbacks and exfiltration are harder.
      • WAF/IPS: Block requests carrying an X-AnonResource-Backend or X-BEResource cookie whose value ends in /ecp/ or in ~ followed by digits. This mirrors Microsoft's URL Rewrite logic. Enable the ProxyLogon signatures for CVE-2021-26855 in your Suricata/ET or Snort rule sets and run them in blocking mode.
      • Endpoint hardening: Use ASR rules or application control on the Exchange host to deny child processes of w3wp.exe and UMWorkerProcess.exe. Keep Microsoft's recommended Exchange AV exclusions, but never exclude aspnet_client or FrontEnd\HttpProxy.
      • IAM/least privilege: Review and reduce the domain-object rights of "Exchange Windows Permissions" and "Exchange Trusted Subsystem" (split permissions model). Allow admin logons to Exchange from PAWs only.
      • Configuration: Disable Unified Messaging services you don't use (this covers chained CVE-2021-26857). Audit and reset tampered OAB virtual directory ExternalUrl values (chained CVE-2021-27065).

    3. Runbook step 3

      Detection rules

      • HttpProxy logs (SSRF indicator): Search %ExchangeInstallPath%Logging\HttpProxy\* for entries with an empty AuthenticatedUser and an AnchorMailbox like ServerInfo~*/*. PowerShell: Import-Csv (gci -Recurse "$env:ExchangeInstallPath\Logging\HttpProxy" -Filter *.log).FullName | ? { $_.AuthenticatedUser -eq '' -and $_.AnchorMailbox -like 'ServerInfo~*/*' }
      • IIS access logs: Look for POSTs to /ecp/*.js, /ecp/y.js or /owa/auth/*.aspx, and for unknown .aspx files under /aspnet_client/. Cookie fields containing X-BEResource= are also suspicious. SPL: index=iis cs_method=POST (cs_uri_stem="/ecp/*.js" OR cs_uri_stem="/aspnet_client/*.aspx")
      • Process ancestry (Sysmon EID 1 / EDR): Alert when w3wp.exe (MSExchange* app pools) or UMWorkerProcess.exe spawns cmd.exe, powershell.exe, rundll32.exe or procdump. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("w3wp.exe","UMWorkerProcess.exe") and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe")
      • File telemetry (Sysmon EID 11): Flag new .aspx files in inetpub\wwwroot\aspnet_client\, FrontEnd\HttpProxy\owa\auth\ or ecp\auth\. Watch for .zip/.7z archives in C:\ProgramData\, which indicate mailbox staging. Watch for LSASS access, such as comsvcs.dll MiniDump or Sysmon EID 10 targeting lsass.exe.
      • Exchange management log: In the "MSExchange Management" log, look for Event ID 1 recording Set-OabVirtualDirectory with script content in ExternalUrl (<script). Also look for New-MailboxExportRequest issued by unexpected accounts.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Source: CSA/SingCERT, cvelistv5, CISA KEV Catalog, NVD (NIST), CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    MicrosoftMicrosoft Exchange Server 2013 Cumulative Update 21
    • 15.00.0 – < 15.00.1395.012
    • 15.00.1395.012
    MicrosoftMicrosoft Exchange Server 2013 Cumulative Update 22
    • 15.00.0 – < 15.00.1473.006
    • 15.00.1473.006
    MicrosoftMicrosoft Exchange Server 2013 Cumulative Update 23
    • 15.00.0 – < 15.00.1497.012
    • 15.00.1497.012
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 10
    • 15.01.0 – < 15.01.1531.012
    • 15.01.1531.012
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 11
    • 15.01.0 – < 15.01.1591.018
    • 15.01.1591.018
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 12
    • 15.01.0 – < 15.01.1713.010
    • 15.01.1713.010
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 13
    • 15.01.0 – < 15.01.1779.008
    • 15.01.1779.008
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 14
    • 15.01.0 – < 15.01.1847.012
    • 15.01.1847.012
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 15
    • 15.01.0 – < 15.01.1913.012
    • 15.01.1913.012
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 16
    • 15.01.0 – < 15.01.1979.008
    • 15.01.1979.008
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 17
    • 15.01.0 – < 15.01.2044.013
    • 15.01.2044.013
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 18
    • 15.01.0 – < 15.01.2106.013
    • 15.01.2106.013
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 19
    • 15.01.0 – < 15.01.2176.009
    • 15.01.2176.009
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 8
    • 15.01.0 – < 15.01.1415.010
    • 15.01.1415.010
    MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 9
    • 15.01.0 – < 15.01.1466.016
    • 15.01.1466.016
    MicrosoftMicrosoft Exchange Server 2019
    • 15.02.0 – < 15.02.0221.018
    • 15.02.0221.018
    MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 1
    • 15.02.0 – < 15.01.1979.006
    • 15.01.1979.006
    MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 2
    • 15.02.0 – < 15.02.0397.011
    • 15.02.0397.011
    MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 3
    • 15.02.0 – < 15.02.0464.015
    • 15.02.0464.015
    MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 4
    • 15.02.0 – < 15.02.0659.012
    • 15.02.0659.012
    MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 5
    • 15.02.0 – < 15.02.0595.008
    • 15.02.0595.008
    MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 6
    • 15.02.0 – < 15.02.0529.013
    • 15.02.0529.013
    MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 7
    • 15.02.0 – < 15.02.0721.013
    • 15.02.0721.013
    MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 8
    • 15.02.0 – < 15.02.0792.010
    • 15.02.0792.010
    microsoftexchange_server
    • 2019
    • 2013
    • 2016
    • —
    • —
    • —

    Vendors and products

    Weakness classes (CWE)

    • CWE-918Server-Side Request Forgery (SSRF)

      Base

      The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

      Entry at MITRE CWE-918

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    CSA/SingCERTActive Exploitation of Vulnerabilities in Microsoft Exchange Server (opens in a new tab)CSA/SingCERTactively exploited
    ANSSI / CERT-FRLicence Ouverte 2.0, as of CERTFR-2021-ALE-004 – [MàJ] Multiples vulnérabilités dans Microsoft Exchange Server (clôturée 2021-07-16) (opens in a new tab)cert.cyber.gouv.fractively exploited
    Packet StormMicrosoft Exchange 2019 SSRF Arbitrary File Write (opens in a new tab)packetstormsecurity.comPoC (publicly reported)reported, not verified—
    Packet StormMicrosoft Exchange ProxyLogon Remote Code Execution (opens in a new tab)packetstormsecurity.comPoC (publicly reported)reported, not verified—
    Packet StormMicrosoft Exchange 2019 Unauthenticated Email Download (opens in a new tab)packetstormsecurity.comPoC (publicly reported)reported, not verified—
    Packet StormMicrosoft Exchange ProxyLogon Collector (opens in a new tab)packetstormsecurity.comPoC (publicly reported)reported, not verified—
    PoC-in-GitHub (nomi-sec)Triage-CVE-2021-26855-ProxyLogon---Microsoft-Exchange- (opens in a new tab)github.comPoC (publicly reported)reported, not verified

    References & sources

    • portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2021-26855x_refsource_MISC, x_transferred
    • packetstormsecurity.comfiles/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.…x_refsource_MISC, x_transferred
    • packetstormsecurity.comfiles/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Executio…x_refsource_MISC, x_transferred
    • packetstormsecurity.comfiles/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Down…x_refsource_MISC, x_transferred
    • packetstormsecurity.comfiles/162736/Microsoft-Exchange-ProxyLogon-Collector.htmlx_refsource_MISC, x_transferred
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855government-resource
    • Microsoft Security Update GuideMicrosoft Exchange Server Remote Code Execution VulnerabilityVendor advisory, Patch
    • cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2021-ALE-004 – [MàJ] Multiples vulnérabilités dans Microsoft Exchange Server (clôturée 2021-07-16)cert-fr

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedMicrosoft

      Show 12 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Referenceadded
      —
      https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
      Referenceremoved
      http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html
      —
      Referenceremoved
      http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html
      —
      Referenceremoved
      http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html
      —
      Referenceremoved
      http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
      —
      Referenceremoved
      https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855
      —
      Reference typeremoved
      http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html Types: Exploit, Third Party Advisory, VDB Entry
      —
      Reference typeremoved
      http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html Types: Exploit, Third Party Advisory, VDB Entry
      —
      Reference typeremoved
      http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html Types: Exploit, Third Party Advisory, VDB Entry
      —
      Reference typeremoved
      http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html Types: Exploit, Third Party Advisory, VDB Entry
      —
      Reference typeremoved
      https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855 Types: Patch, Vendor Advisory
      —
      Affected versions (publisher)changed
      Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Exchange Server 2019 Cumulative Update 8, Microsoft Exchange Server 2019 (+21)
      Microsoft Exchange Server 2013 Cumulative Update 21, Microsoft Exchange Server 2013 Cumulative Update 22, Microsoft Exchange Server 2013 Cumulative Update 23 (+21)

      Source identifier: secure@microsoft.com

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2021-26855
    <a href="https://intel.neosec.eu/en/cve/CVE-2021-26855"><img src="https://intel.neosec.eu/badge/cve/CVE-2021-26855.svg?lang=en" alt="CVE-2021-26855 – NEOSEC Intel" height="20"></a>