CVE-2021-26855Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Reported by 4 independent sources · first reported by Huntress · last reported
Last reported 3 months ago
Fix due 3 May 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 6 Oct 2026
What the reports say
6 reports, newest first · the exact sentence from each-
June 2026 CVE Landscape“CVE-2021-26855”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“…e have observed them targeting server-based N-day vulnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).”
-
Ten Years of Resilience, Innovation & Community-Driven Defense“These vulnerabilities, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, affected Exchange Server 2013, 2016, and 2019 and created a perfect storm of security weaknesses that attackers chained together for maximum impact.”
-
GreyNoise Detects Active Exploitation of Silk Typhoon-Linked CVEs“CVE-2021-26855, CVE-2021-44228 (Log4Shell), and CVE-2024-3400 are being actively targeted by threat actors.”
-
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs“CVE-2021-26855 – Microsoft Exchange Server RCE (ProxyLogon)”
-
Rapid Response: Mass Exploitation of On-Prem Exchange Servers“CVE-2021-26855”
Indicators reported together
named in the same reportsAlso named with it: CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-44228, CVE-2025-55182, CVE-2022-27925, CVE-2023-20198, CVE-2024-21762, CVE-2022-41082, CVE-2024-3400, CVE-2024-1709, CVE-2024-1708, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-35616, CVE-2026-33825, CVE-2026-21509
Thanks — we review every report.