CVE DatabaseCVE-2021-26855

Updated 2026-08-19한국어 권고문 →

CVE-2021-268559.1/CRITICALCISA KEVCWE-918CWE-918

Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability (ProxyLogon SSRF) - CVE-2021-26855

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

exchange_server

Published Date

2021-03-03

CVSS v3.1

9.1

CRITICAL

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

On-premises Microsoft Exchange Server 2013, 2016, and 2019

Impact

Unauthenticated remote attackers can bypass authentication, access sensitive mailbox data, and chain with other vulnerabilities to execute arbitrary code (RCE)

Mitigation

Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (SU), or implement IIS URL Rewrite rules to block malicious requests

Affected Products & Version Scope

Microsoft Exchange Server 2013, 2016, and 2019 (All On-Premises deployments)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Identify your current Exchange Server Cumulative Update (CU) level and apply the latest Security Update (SU) immediately. Use the following PowerShell commands to verify your version and restart services after patching.

powershell

# Check current Exchange Server version and build number
Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion

# Restart IIS and Exchange services after applying the security patch
Restart-Service W3SVC, MSExchangeIS, MSExchangeMailboxAssistants

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, configure an IIS URL Rewrite rule to block incoming requests containing the malicious headers.

xml

<!-- Add the following rewrite rule to your web.config or applicationHost.config -->
<system.webServer>
  <rewrite>
    <rules>
      <rule name='Block ProxyLogon SSRF' stopProcessing='true'>
        <match url='.*' />
        <conditions>
          <add input='{HTTP_X_ANONRESOURCE_BACKEND}' pattern='.*' />
        </conditions>
        <action type='CustomResponse' statusCode='403' statusReason='Forbidden' statusDescription='Blocked by Security Policy' />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

3. Log Audit & IoC Verification Commands

Scan the Exchange HttpProxy logs to detect potential SSRF exploitation attempts and unauthorized backend access.

powershell

# Search HttpProxy logs for suspicious 'X-AnonResource-Backend' or 'X-BEResource' patterns
Get-ChildItem -Path 'C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy' -Recurse -Filter '*.log' |
  Select-String -Pattern 'X-AnonResource-Backend' |
  Select-Object Path, LineNumber, Line | Out-File -FilePath 'C:  emp\ProxyLogon_IoC_Detection.txt'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Organizations running on-premises Exchange Servers must apply the official Microsoft security updates immediately and restrict external access to Exchange management interfaces.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-26855) is a Server-Side Request Forgery (SSRF) vulnerability residing in the frontend architecture of Microsoft Exchange Server. Exchange utilizes a frontend-backend architecture where the frontend (IIS) proxies client requests to backend services. Due to inadequate validation of specific HTTP headers, such as 'X-AnonResource-Backend' and 'X-BEResource', an unauthenticated attacker can craft malicious HTTP requests that force the frontend to proxy requests to arbitrary backend endpoints under the context of the local system.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates the exploit by sending a specially crafted HTTP POST/GET request to port 443 (HTTPS) of the target Exchange server. By manipulating the 'X-BEResource' header to point to internal backend resources (e.g., localhost:444/ecp), the frontend proxy module processes the request as a trusted internal communication. This allows the attacker to bypass authentication and interact with backend APIs as 'NT AUTHORITY\SYSTEM'. This SSRF is commonly chained with other vulnerabilities (such as CVE-2021-26857 or CVE-2021-26858) to write arbitrary files (WebShells) and achieve full Remote Code Execution (RCE).

3. Infrastructure & Business Impact

As a highly critical vulnerability listed in the CISA KEV with an EPSS score of 1.0, this flaw has been actively exploited by advanced persistent threat (APT) actors globally. Successful exploitation allows unauthorized access to the entire corporate email database, leading to massive data exfiltration. Furthermore, attackers can leverage the compromised Exchange server to perform lateral movement within the Active Directory (AD) environment, deploy ransomware, and completely compromise the enterprise infrastructure.

Official Vendor Advisories & References

NVD Original English Description

Microsoft Exchange Server Remote Code Execution Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855

Source: secure@microsoft.com · Patch, Vendor Advisory

http://packetstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26855

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

Frequently Asked SecOps Questions (CVE-2021-26855)

FAQ

Q1. How critical is CVE-2021-26855 and is it actively exploited in the wild?

CVE-2021-26855 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-26855?

Primary impacted vendors include microsoft across exchange_server. Scope summary: Microsoft Exchange Server 2013, 2016, and 2019 (All On-Premises deployments)

Q3. What temporary mitigations or workarounds exist for CVE-2021-26855 before patching?

[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (SU), or implement IIS URL Rewrite rules to block malicious requests Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION