CVE-2021-26857KEV Β· OVERDUECWE-502insecure-deserialization

Microsoft Exchange Server Remote Code Execution Vulnerability

High Β· published March 3, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
7.8
EPSS
96%
Percentile
99.9
In the wild
Confirmed
What it is

🚨 A vulnerable Microsoft Exchange Server opens the door for attackers to execute any code they want, potentially unleashing chaos! πŸ”₯ Imagine a delivery driver who’s been given a blank check to enter your house and take whatever they please. That’s what this flaw does, allowing cybercriminals unrestricted access to your server if they gain control. An attacker could exploit this vulnerability to run arbitrary code on your Exchange Server, which might lead to unauthorized access, data theft, or even complete takeover of your system. The consequences could be devastating, including loss of sensitive information and damage to your organization's reputation.

Put simply

Imagine a delivery driver who’s been given a blank check to enter your house and take whatever they please. That’s what this flaw does, allowing cybercriminals unrestricted access to your server if they gain control. This remote code execution vulnerability arises from improper validation of commands in Microsoft Exchange Server. When exploited, it allows unauthorized users to execute code remotely, effectively taking control of the server.

What to do

An attacker could exploit this vulnerability to run arbitrary code on your Exchange Server, which might lead to unauthorized access, data theft, or even complete takeover of your system. The consequences could be devastating, including loss of sensitive information and damage to your organization's reputation. Immediate action is crucial! Update your Microsoft Exchange Server to the latest patch level available. Ensure that you audit your systems for any unauthorized access and consider implementing additional security measures, like network segmentation. Don't wait! You've got this! With prompt action, you can secure your Exchange Server and keep your data safe. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.8 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.95762 Β· 99.9th percentile
Weakness
CWE-502 Β· Deserialization of Untrusted Data
Published
2021-03-03T05:15Z
KEV added
2021-11-03 Β· due 2022-05-03
Affected products (26)
ProductVersionsFixed in
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
References (3)
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV β€” remediate by May 3
    kev
  • 02 MAR 23:55Z
    Microsoft Exchange Server Remote Code Execution Vulnerability
    cvelistv5