CVE-2021-26858

Think of Microsoft Exchange Server as the “mail traffic controller” for your company’s emails. This bug is like a door in that controller that can be exploited to get attackers to run harmful commands on the server. If attackers get that access, they can potentially take over the system and disrupt email, and it’s been used in ransomware campaigns.

This matters if your business runs Microsoft Exchange Server on the specified Exchange Server cumulative update lines (including Microsoft Exchange Server 2013 and 2016 cumulative updates listed in the affected set). Because it’s been used in ransomware campaigns, you should treat it seriously if your Exchange version is not yet at the Microsoft fixed builds. Act only if the vulnerable Microsoft Exchange Server version is installed and reachable for your organization’s Exchange usage scenario (for example, if the Exchange service is exposed to the internet and can receive attacker traffic).

This is RED because the vulnerability is confirmed in the CISA KEV as being used in ransomware campaigns, meaning attackers have already found practical ways to take advantage of it. The required action is to apply the vendor’s updates, and the CISA remediation due date has already passed (2022-05-03).

1. Confirm exposure on your servers

   • On each system running Microsoft Exchange Server, identify the exact Exchange version and installed Microsoft Exchange Server Cumulative Update level.
   • Determine whether that installed cumulative update matches one of the tracks listed in the fix cards (e.g., Exchange 2013 CU21/CU22/CU23 or Exchange 2016 CU10 through CU18) and whether it is at or before the vulnerable build.

2. Apply the correct Microsoft fixes

   • Upgrade each affected Exchange server to the fixed build that corresponds to your currently installed cumulative update track:
     • Exchange 2013 CU21 → 15.00.1395.012
     • Exchange 2013 CU22 → 15.00.1473.006
     • Exchange 2013 CU23 → 15.00.1497.012
     • Exchange 2016 CU10 → 15.01.1531.012
     • Exchange 2016 CU11 → 15.01.1591.018
     • Exchange 2016 CU12 → 15.01.1713.010
     • Exchange 2016 CU13 → 15.01.1779.008
     • Exchange 2016 CU14 → 15.01.1847.012
     • Exchange 2016 CU15 → 15.01.1913.012
     • Exchange 2016 CU16 → 15.01.1979.008
     • Exchange 2016 CU17 → 15.01.2044.013
     • Exchange 2016 CU18 → 15.01.2106.013
   • Follow Microsoft’s official update instructions from the MSRC update guide for CVE-2021-26858.

3. Validate the fix

   • After patching, confirm the Exchange binaries/build numbers reflect the fixed versions above.
   • Ensure Exchange services are running normally and email flow is working.

4. If patching is delayed (temporary risk reduction)

   • Reduce external exposure of Exchange services wherever possible (for example, restrict inbound access to only required sources and ensure firewall rules align with your intended access).
   • Increase monitoring for Exchange-related suspicious behavior (unexpected web requests to Exchange endpoints, unusual process creation under Exchange-related service accounts, and other signs of post-exploitation).

5. CISA due date context and what to monitor

   • CISA KEV remediation due date: 2022-05-03.
   • Since exploitation has been observed in ransomware campaigns, focus monitoring on indicators that an attacker may already have gained control, and confirm no unexpected persistence exists after patching.

CVE-2021-26858 is an Exchange Server Remote Code Execution vulnerability. It is listed in CISA KEV and has been used in ransomware campaigns, so exploitation should be treated as real and actively relevant. While EPSS indicates a very high predicted likelihood (trend rising), the KEV listing is the stronger signal for real-world risk and drives the urgent remediation expectation. No public exploit code was found in the provided findings, but that does not reduce the practical risk given confirmed abuse. Patch guidance is provided by Microsoft via MSRC for the specific Exchange 2013/2016 cumulative update tracks and fixed build numbers listed in the findings.