CVE-2021-26855

This vulnerability lets a remote attacker break into Microsoft Exchange Server and run code on it, even without a login. Think of Exchange as the front-desk computer for your email—if someone can run code there, they can potentially redirect emails, steal data, or set up ransomware. Because it can be triggered over the network without authentication, it’s the kind of issue that can be actively used by attackers.

This matters if your business runs Microsoft Exchange Server 2013 Cumulative Update 22/23, Microsoft Exchange Server 2016 Cumulative Update 13/14/19, or Microsoft Exchange Server 2019 (including Cumulative Update 2/3/4/8). It’s relevant when your Exchange server is reachable over the network, because the flaw does not require authentication or user interaction. Treat it as a risk when an attacker can reach the Exchange server endpoint from outside your organization (for example, via an internet-facing setup).

This is RED because confirmed real-world exploitation has been tied to ransomware activity, and it appears in CISA’s Known Exploited Vulnerabilities list. Attackers can use it to run code remotely without any login, so the window between exposure and compromise can be short—patching should be treated as immediate priority.

1. Confirm exposure (what to check)

   • Identify whether you run Microsoft Exchange Server in these branches: Microsoft Exchange Server 2013, Microsoft Exchange Server 2016, or Microsoft Exchange Server 2019.
   • Determine your exact installed Cumulative Update level (for example, “Cumulative Update 8” for Exchange 2019).
   • If your installed version is listed among the affected cumulative updates for CVE-2021-26855, you should assume you are vulnerable.

2. Get the correct fix

   • Use Microsoft’s official remediation guidance for CVE-2021-26855 (the vendor advisory/update guide linked in the findings).
   • Follow Microsoft’s instructions for upgrading Exchange to the fixed state for your specific Cumulative Update branch.

3. Upgrade plan

   • Schedule maintenance downtime as needed for Exchange updates.
   • Apply the Microsoft Exchange Server update(s) that move you from the vulnerable cumulative update to the fixed state indicated by Microsoft guidance.
   • After installation, verify the Exchange build/cumulative update level matches the fixed guidance.

4. If patching is delayed (temporary containment)

   • Reduce the chance of remote exploitation by ensuring Exchange is not directly reachable from the public internet.
   • Allow only the necessary network paths (for example, internal access or controlled VPN access), and block unnecessary inbound access at your firewall/load balancer.
   • Maintain heightened monitoring while you work through the patch.

5. Monitoring after remediation

   • Check Exchange-related logs for unusual activity around the time window before and after patching (the specific log locations depend on your Exchange configuration).
   • Look for indicators of compromise such as unexpected service behavior or suspicious outbound connections from the Exchange host.

6. Timing note (CISA due date)

   • CISA’s remediation due date for the KEV entry was 2022-05-03. Given active use in ransomware campaigns, treat the patch as a same-day/next-day priority when feasible.

Severity is critical (remote code execution with no authentication or user interaction). The weakness is classified as CWE-918 (Server-Side Request Forgery is not indicated; instead the finding describes remote code execution). Attack vector is network-based, and the findings state an attacker can execute arbitrary code on the Exchange Server remotely without authentication when the Exchange Server is accessible.

Exploitation status: This vulnerability is listed in CISA KEV and has been used in ransomware campaigns, which outweighs purely predictive scoring. Reported exploitation includes use of SharkLoader to deploy Cobalt Strike Beacon via exploitation of internet-facing applications, including Microsoft Exchange.

Patch status: Microsoft has fixed the issue across multiple Exchange branches; the findings note fixed states for several Exchange Server 2013/2016/2019 cumulative updates, with Microsoft remediation guidance available for CVE-2021-26855.

KEV meaning here: CISA KEV indicates the issue is known to be exploited in the wild, so it should be treated as actively weaponized rather than theoretical.