CVE-2021-26858VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-26858: Microsoft Exchange Server Remote Code Execution Vulnerability

Affects Microsoft Exchange ServerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
Ransomware: Used in ransomware campaigns
EPSS: 93.7% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

Description

CVE-2021-26858 is a remote code execution vulnerability in Microsoft Exchange Server. It is part of the ProxyLogon exploit chain and has been exploited in the wild. This vulnerability has been used in known ransomware campaigns, posing a significant risk to affected systems.

Summary

Microsoft Exchange Server contains an unspecified remote code execution vulnerability identified as CVE-2021-26858. This vulnerability is a component of the ProxyLogon exploit chain, which has been actively exploited in the wild. The flaw enables attackers to execute arbitrary code remotely on vulnerable Exchange Server instances, facilitating further malicious activities including ransomware deployment.

Impact

Successful exploitation of CVE-2021-26858 allows remote attackers to execute arbitrary code on affected Microsoft Exchange Server systems. This can lead to full system compromise, data theft, disruption of email services, and deployment of ransomware, as evidenced by known ransomware campaigns leveraging this vulnerability.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this vulnerability is part of a known exploit chain actively used in the wild, it is critical to monitor official Microsoft advisories for patches or mitigations. Until a patch is applied, consider implementing recommended workarounds or temporary mitigations provided by Microsoft.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:11:02 UTC

References

Related threats