CVE-2021-26855

critical

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

References

https://cyware.com/resources/research-and-analysis/beneath-the-surface-avoslockers-ransomware-as-a-service-and-cybercrime-tactics-f14f

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a

https://www.tenable.com/cyber-exposure/a-look-inside-the-ransomware-ecosystem

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-117a

https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates

https://www.tenable.com/cyber-exposure/2021-threat-landscape-retrospective

https://web.archive.org/web/20211025233339/https://twitter.com/pancak3lullz/status/1452679527197560837

https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a

https://www.tenable.com/blog/proxyshell-attackers-actively-scanning-for-vulnerable-microsoft-exchange-servers-cve-2021-34473

https://news.sophos.com/en-us/2021/03/23/blackkingdom-ransomware-still-exploiting-insecure-exchange-servers/

https://www.tenable.com/blog/how-to-identify-compromised-microsoft-exchange-server-assets-using-tenable

https://www.tenable.com/blog/how-to-identify-compromised-microsoft-exchange-server-assets-using-tenable

https://news.sophos.com/en-us/2021/03/15/dearcry-ransomware-attacks-exploit-exchange-server-vulnerabilities/

https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/

https://www.tenable.com/blog/finding-proxylogon-and-related-microsoft-exchange-vulnerabilities-how-tenable-can-help

https://www.tenable.com/blog/finding-proxylogon-and-related-microsoft-exchange-vulnerabilities-how-tenable-can-help

https://www.tenable.com/blog/cve-2021-26855-cve-2021-26857-cve-2021-26858-cve-2021-27065-four-microsoft-exchange-server-zero-day-vulnerabilities

https://www.tenable.com/blog/cve-2021-26855-cve-2021-26857-cve-2021-26858-cve-2021-27065-four-microsoft-exchange-server-zero-day-vulnerabilities

https://msrc.microsoft.com/blog/2021/03/multiple-security-updates-released-for-exchange-server/

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855

Details

Source: Mitre, NVD

Published: 2021-03-03

Updated: 2024-02-15

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical