CVE-2021-26855

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS breakdown

Affected products

• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2013 – 2013
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2013 – 2013
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2013 – 2013
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2019 – 2019
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2016 – 2016
• microsoft / exchange_server2019 – 2019
• microsoft / Microsoft Exchange Server 2013 Cumulative Update 2115.00.0 – 15.00.1395.012
• microsoft / Microsoft Exchange Server 2013 Cumulative Update 2215.00.0 – 15.00.1473.006
• microsoft / Microsoft Exchange Server 2013 Cumulative Update 2315.00.0 – 15.00.1497.012
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1015.01.0 – 15.01.1531.012
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1115.01.0 – 15.01.1591.018
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1215.01.0 – 15.01.1713.010
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1315.01.0 – 15.01.1779.008
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1415.01.0 – 15.01.1847.012
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1515.01.0 – 15.01.1913.012
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1615.01.0 – 15.01.1979.008
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1715.01.0 – 15.01.2044.013
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1815.01.0 – 15.01.2106.013
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 1915.01.0 – 15.01.2176.009
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 815.01.0 – 15.01.1415.010
• microsoft / Microsoft Exchange Server 2016 Cumulative Update 915.01.0 – 15.01.1466.016
• microsoft / Microsoft Exchange Server 201915.02.0 – 15.02.0221.018
• microsoft / Microsoft Exchange Server 2019 Cumulative Update 115.02.0 – 15.01.1979.006
• microsoft / Microsoft Exchange Server 2019 Cumulative Update 215.02.0 – 15.02.0397.011
• microsoft / Microsoft Exchange Server 2019 Cumulative Update 315.02.0 – 15.02.0464.015
• microsoft / Microsoft Exchange Server 2019 Cumulative Update 415.02.0 – 15.02.0659.012
• microsoft / Microsoft Exchange Server 2019 Cumulative Update 515.02.0 – 15.02.0595.008
• microsoft / Microsoft Exchange Server 2019 Cumulative Update 615.02.0 – 15.02.0529.013
• microsoft / Microsoft Exchange Server 2019 Cumulative Update 715.02.0 – 15.02.0721.013
• microsoft / Microsoft Exchange Server 2019 Cumulative Update 815.02.0 – 15.02.0792.010

Exploits & proofs of concept

• exploit-dbMicrosoft Exchange 2019 - Unauthenticated Email Download (Metasploit)by mekhalleh
• exploit-dbMicrosoft Exchange 2019 - Unauthenticated Email Downloadby Gonzalo Villegas
• exploit-dbMicrosoft Exchange 2019 - Server-Side Request Forgeryby F5
• exploit-dbMicrosoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC)by testanull
• nucleiMicrosoft Exchange Server SSRF Vulnerabilityby madrobot

References

• VENDOR_ADVISORYhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855