CVE-2021-26857VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-26857: Microsoft Exchange Server Remote Code Execution Vulnerability

Affects Microsoft Exchange ServerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
Ransomware: Used in ransomware campaigns
EPSS: 95.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

Description

CVE-2021-26857 is a remote code execution vulnerability in Microsoft Exchange Server. It is part of the ProxyLogon exploit chain and has been exploited in the wild, including use in ransomware campaigns. The vulnerability allows attackers to execute arbitrary code on affected Exchange servers.

Summary

Microsoft Exchange Server contains an unspecified remote code execution vulnerability identified as CVE-2021-26857. This vulnerability is a component of the ProxyLogon exploit chain, which has been actively exploited in the wild. The flaw enables attackers to execute arbitrary code remotely on vulnerable Exchange Server instances. It has been associated with known ransomware campaigns, highlighting its critical nature. Specific affected versions are not detailed in the provided data.

Impact

Successful exploitation of CVE-2021-26857 allows remote attackers to execute arbitrary code on Microsoft Exchange Server systems. This can lead to full system compromise, data theft, and deployment of ransomware. The vulnerability has been actively exploited in the wild, increasing the risk to affected organizations.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor official Microsoft advisories for patches or mitigations related to CVE-2021-26857. Due to active exploitation, applying vendor-provided fixes or workarounds promptly is critical once available.

Weaknesses

CWE-502Deserialization of Untrusted Data (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:10:39 UTC

Weaknesses

References

Related threats