Skip to content
OpenAdvisories
Critical · 9.1 Known exploited · Ransomware Scanner template Public exploit CVE-2021-26855 EUVD-2021-13639GHSA-6784-2mh5-cq56

Microsoft Exchange Server Remote Code Execution Vulnerability

Published Mar 2, 2021 · Updated Aug 19, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft Exchange Server 2013 Cumulative Update 21 Product: Microsoft Exchange Server 2013 Cumulative Update 22 Product: Microsoft Exchange Server 2013 Cumulative Update 23 Product: Microsoft Exchange Server 2016 Cumulative Update 10 Product: Microsoft Exchange Server 2016 Cumulative Update 11 Product: Microsoft Exchange Server 2016 Cumulative Update 12 Product: Microsoft Exchange Server 2016 Cumulative Update 13 Product: Microsoft Exchange Server 2016 Cumulative Update 14 Product: Microsoft Exchange Server 2016 Cumulative Update 15 Product: Microsoft Exchange Server 2016 Cumulative Update 16 Product: Microsoft Exchange Server 2016 Cumulative Update 17 Product: Microsoft Exchange Server 2016 Cumulative Update 18 Product: Microsoft Exchange Server 2016 Cumulative Update 19 Product: Microsoft Exchange Server 2016 Cumulative Update 8 Product: Microsoft Exchange Server 2016 Cumulative Update 9 Product: Microsoft Exchange Server 2019 Product: Microsoft Exchange Server 2019 Cumulative Update 1 Product: Microsoft Exchange Server 2019 Cumulative Update 2 Product: Microsoft Exchange Server 2019 Cumulative Update 3 Product: Microsoft Exchange Server 2019 Cumulative Update 4 Product: Microsoft Exchange Server 2019 Cumulative Update 5 Product: Microsoft Exchange Server 2019 Cumulative Update 6 Product: Microsoft Exchange Server 2019 Cumulative Update 7 Product: Microsoft Exchange Server 2019 Cumulative Update 8

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Affected products

VendorProductAffectedFixed
Microsoft Microsoft Exchange Server 2013 Cumulative Update 21 15.00.0 – < 15.00.1395.012 15.00.1395.012
Microsoft Microsoft Exchange Server 2013 Cumulative Update 22 15.00.0 – < 15.00.1473.006 15.00.1473.006
Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 15.00.0 – < 15.00.1497.012 15.00.1497.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 10 15.01.0 – < 15.01.1531.012 15.01.1531.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 11 15.01.0 – < 15.01.1591.018 15.01.1591.018
Microsoft Microsoft Exchange Server 2016 Cumulative Update 12 15.01.0 – < 15.01.1713.010 15.01.1713.010
Microsoft Microsoft Exchange Server 2016 Cumulative Update 13 15.01.0 – < 15.01.1779.008 15.01.1779.008
Microsoft Microsoft Exchange Server 2016 Cumulative Update 14 15.01.0 – < 15.01.1847.012 15.01.1847.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 15 15.01.0 – < 15.01.1913.012 15.01.1913.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 16 15.01.0 – < 15.01.1979.008 15.01.1979.008
Microsoft Microsoft Exchange Server 2016 Cumulative Update 17 15.01.0 – < 15.01.2044.013 15.01.2044.013
Microsoft Microsoft Exchange Server 2016 Cumulative Update 18 15.01.0 – < 15.01.2106.013 15.01.2106.013
Microsoft Microsoft Exchange Server 2016 Cumulative Update 19 15.01.0 – < 15.01.2176.009 15.01.2176.009
Microsoft Microsoft Exchange Server 2016 Cumulative Update 8 15.01.0 – < 15.01.1415.010 15.01.1415.010
Microsoft Microsoft Exchange Server 2016 Cumulative Update 9 15.01.0 – < 15.01.1466.016 15.01.1466.016
Microsoft Microsoft Exchange Server 2019 15.02.0 – < 15.02.0221.018 15.02.0221.018
Microsoft Microsoft Exchange Server 2019 Cumulative Update 1 15.02.0 – < 15.01.1979.006 15.01.1979.006
Microsoft Microsoft Exchange Server 2019 Cumulative Update 2 15.02.0 – < 15.02.0397.011 15.02.0397.011
Microsoft Microsoft Exchange Server 2019 Cumulative Update 3 15.02.0 – < 15.02.0464.015 15.02.0464.015
Microsoft Microsoft Exchange Server 2019 Cumulative Update 4 15.02.0 – < 15.02.0659.012 15.02.0659.012
Microsoft Microsoft Exchange Server 2019 Cumulative Update 5 15.02.0 – < 15.02.0595.008 15.02.0595.008
Microsoft Microsoft Exchange Server 2019 Cumulative Update 6 15.02.0 – < 15.02.0529.013 15.02.0529.013
Microsoft Microsoft Exchange Server 2019 Cumulative Update 7 15.02.0 – < 15.02.0721.013 15.02.0721.013
Microsoft Microsoft Exchange Server 2019 Cumulative Update 8 15.02.0 – < 15.02.0792.010 15.02.0792.010

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 3 modules

GitHub 53 repositories · most starred shown

  • Flangvik/SharpProxyLogon ★ 247 · Mar 29, 2021

    C# POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode injection

  • hosch3n/ProxyVulns ★ 177 · Apr 14, 2021

    [ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [ProxyShell] CVE-2021-34473 & CVE-2021-34523 & CVE-2021-31207…

  • dwisiswant0/proxylogscan ★ 166 · Mar 8, 2021

    A fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin (CVE-2021-26855).

  • p0wershe11/ProxyLogon ★ 123 · Mar 17, 2021

    ProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE(SSRF->GetWebShell)

  • h4x0r-dz/CVE-2021-26855 ★ 98 · Mar 9, 2021
  • cert-lv/exchange_webshell_detection ★ 98 · Mar 5, 2021

    Detect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)

  • hackerschoice/CVE-2021-26855 ★ 59 · Mar 11, 2021

    PoC of proxylogon chain SSRF(CVE-2021-26855) to write file by testanull, censored by github

  • alt3kx/CVE-2021-26855_PoC ★ 53 · Mar 10, 2021
  • praetorian-inc/proxylogon-exploit ★ 52 · Mar 24, 2021

    Proof-of-concept exploit for CVE-2021-26855 and CVE-2021-27065. Unauthenticated RCE in Exchange.

  • conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855 ★ 36 · Mar 6, 2021

    Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 1

References