CVE-2021-27065Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 5 months ago
Fix due 3 May 2022
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 13 Oct 2026
What the reports say
3 reports, newest first · the exact sentence from each-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“…lnerabilities, such as the ProxyLogon chain targeting Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065).”
-
Ten Years of Resilience, Innovation & Community-Driven Defense“These vulnerabilities, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, affected Exchange Server 2013, 2016, and 2019 and created a perfect storm of security weaknesses that attackers chained together for maximum impact.”
-
Rapid Response: Mass Exploitation of On-Prem Exchange Servers“CVE-2021-27065”
Indicators reported together
named in the same reports- 4264cfb3980a068a…40e59885f5c8in 1 report
- 2e8f9fd8213d9f69…93d881c04cd2in 1 report
- 8d9433e9734dd629…d344de733c78in 1 report
- d67197bf407e74ec…7df65cf429b3in 1 report
- 141.164.46[.]77in 1 report
- 96.9.125[.]227in 1 report
- 194.38.11[.]3in 1 report
- check.office365-update[.]comin 1 report
- 209.141.40[.]254in 1 report
- zimbra-beta[.]infoin 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2025-55182, CVE-2023-34362, CVE-2017-5638, CVE-2021-44228, CVE-2024-1709, CVE-2024-1708, CVE-2017-0144
Thanks — we review every report.