CVE-2021-26858KEV Β· OVERDUE

Microsoft Exchange Server Remote Code Execution Vulnerability

High Β· published March 3, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1635
days past CISA
deadline
CVSS v3.1
7.8
EPSS
94%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 Microsoft Exchange Server has a remote code execution vulnerability that's been exploited widely! If you’re running an affected version, it’s time to act fast! ⚑ Think of your server like a busy restaurant kitchen where anyone can walk in and start cooking without checking if they belong. This vulnerability lets attackers stir the pot with malicious code, mixing in their own recipes without anyone noticing! An attacker could take full control of your Exchange Server, allowing them to access, manipulate, or even destroy sensitive data without ever being detected. This could lead to catastrophic data breaches and significant operational disruptions, making it a critical issue you cannot ignore! πŸ”₯

Put simply

Think of your server like a busy restaurant kitchen where anyone can walk in and start cooking without checking if they belong. This vulnerability lets attackers stir the pot with malicious code, mixing in their own recipes without anyone noticing! CVE-2021-26858 is a vulnerability in Microsoft Exchange Server that allows remote attackers to execute arbitrary code on the affected system due to improper validation of command inputs. This flaw can be exploited without authentication, making it particularly dangerous.

What to do

An attacker could take full control of your Exchange Server, allowing them to access, manipulate, or even destroy sensitive data without ever being detected. This could lead to catastrophic data breaches and significant operational disruptions, making it a critical issue you cannot ignore! πŸ”₯ To protect your environment, immediately patch your Microsoft Exchange Server to the latest version where this vulnerability has been addressed. Regularly review your security configurations and consider implementing additional monitoring to catch any suspicious activities. πŸ”’ You’ve got this! By taking swift action, you can turn your server into a fortress! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.8 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.93651 Β· 99.8th percentile
Published
2021-03-03T05:15Z
KEV added
2021-11-03 Β· due 2022-05-03
Affected products (24)
ProductVersionsFixed in
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
microsoft/exchange_serverall versionsβ€”
References (3)
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV β€” remediate by May 3
    kev
  • 02 MAR 23:55Z
    Microsoft Exchange Server Remote Code Execution Vulnerability
    cvelistv5