ProxyLogon — Microsoft Exchange Server Server-Side Request Forgery
A server-side request forgery vulnerability in Microsoft Exchange Server allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange server. Chained with three additional Exchange vulnerabilities (CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) it delivers full pre-authentication remote code execution — the "ProxyLogon" chain exploited at mass scale in early 2021.
- Vendor
- Microsoft
- Product
- Exchange Server
- CVSS
- 9.8
- EPSS (exploit probability)
- 100.0%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2021-26855 being exploited?
Yes. CISA added CVE-2021-26855 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 100.0% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2021-26855 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (181 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2021-26855 is the first link in the “ProxyLogon” exploit chain against on-premises Microsoft Exchange Server, disclosed on March 2, 2021. On its own, it’s a server-side request forgery bug letting an unauthenticated attacker make Exchange send requests on their behalf and authenticate as the server itself. Chained with a following-stage arbitrary-file-write vulnerability, an attacker could drop a webshell and gain persistent, unauthenticated remote code execution — no credentials needed at any point.
Why it mattered
Microsoft disclosed the chain alongside emergency patches after detecting active, targeted exploitation by a threat group Microsoft named Hafnium, which had been using it against on-premises Exchange servers to exfiltrate mailbox data. Within days of disclosure, exploitation shifted from narrow, targeted espionage to indiscriminate mass scanning and webshell deployment by multiple opportunistic actor groups — tens of thousands of organizations running on-premises Exchange were compromised worldwide before most had even applied the patch, prompting an unusual step: the FBI obtained a court order to remotely remove webshells from privately owned servers that hadn’t been cleaned up.
CISA issued an emergency directive requiring federal agencies to patch or disconnect vulnerable Exchange servers within days rather than the usual weeks. Full technical detail and the complete four-CVE chain are documented in Microsoft’s security response and at the NVD link above.
Other Microsoft Exchange Server CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 2.7% | — |
| CVE-2023-21529 Microsoft Exchange Server Deserialization of Untrusted Data Vulnerabilityransomware use | [ HIGH ] | 8.8 | 59.3% | |
| CVE-2021-31196 Microsoft Exchange Server Information Disclosure Vulnerability | [ HIGH ] | 7.2 | 54.1% | |
| CVE-2024-21410 Microsoft Exchange Server Privilege Escalation Vulnerability | [ CRITICAL ] | 9.8 | 12.7% | |
| CVE-2022-41080 Microsoft Exchange Server Privilege Escalation Vulnerabilityransomware use | [ HIGH ] | 8.8 | 77.3% | |
| CVE-2022-41082 Microsoft Exchange Server Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 8.0 | 100.0% | |
| CVE-2022-41040 Microsoft Exchange Server Server-Side Request Forgery Vulnerabilityransomware use | [ HIGH ] | 8.8 | 100.0% | |
| CVE-2018-8581 Microsoft Exchange Server Privilege Escalation Vulnerabilityransomware use | [ HIGH ] | 7.4 | 27.6% |
