CVE-2021-26855KEV ยท OVERDUECWE-918ssrf

Microsoft Exchange Server Remote Code Execution Vulnerability

Critical ยท published March 3, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.1. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
9.1
EPSS
100%
Percentile
100.0
In the wild
Confirmed
What it is

๐Ÿšจ An astonishingly simple exploit allows remote code execution on Microsoft Exchange Servers! Any attacker can send a single crafted request to take control of your entire system. ๐Ÿ”ฅ Think of it like a hotel with a front desk that hands out keys to anyone who asks, no ID required. This vulnerability lets attackers check into your server and do whatever they like, all without being questioned! An attacker could execute arbitrary code on the server, leading to full control over sensitive data, system configurations, and even the ability to spread malware across the network. The consequences could be absolutely devastating, compromising the integrity and confidentiality of your organization's communications.

Put simply

Think of it like a hotel with a front desk that hands out keys to anyone who asks, no ID required. This vulnerability lets attackers check into your server and do whatever they like, all without being questioned! CVE-2021-26855 is a remote code execution vulnerability in Microsoft Exchange Server that allows attackers to send specially crafted requests to execute code with the privileges of the server's process. This flaw can be exploited without authentication, making it especially dangerous.

What to do

An attacker could execute arbitrary code on the server, leading to full control over sensitive data, system configurations, and even the ability to spread malware across the network. The consequences could be absolutely devastating, compromising the integrity and confidentiality of your organization's communications. Immediate action is crucial! Patch Microsoft Exchange Server to the latest version to close this vulnerability. Ensure that all systems are updated and consider additional monitoring for unusual activities on your network. Don't wait โ€” act now! You've got this! By following these steps, you can secure your environment and keep those pesky attackers at bay. ๐Ÿ›ก๏ธ

The record
Technical detail
CVSS v3.1
9.1 ยท CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.99996 ยท 100.0th percentile
Weakness
CWE-918 ยท Server-Side Request Forgery (SSRF)
Published
2021-03-03T05:15Z
KEV added
2021-11-03 ยท due 2022-05-03
Affected products (24)
ProductVersionsFixed in
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
microsoft/exchange_serverall versionsโ€”
References (7)
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV โ€” remediate by May 3
    kev
  • 02 MAR 23:55Z
    Microsoft Exchange Server Remote Code Execution Vulnerability
    cvelistv5