CVE DatabaseCVE-2021-26858

Updated 2026-10-01한국어 권고문 →

CVE-2021-268587.8/HIGHCISA KEV

Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26858) Urgent Security Advisory

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

exchange server

Published Date

2021-03-03

CVSS v3.1

7.8

HIGH

EPSS (30d)

93.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Microsoft Exchange Server 2013, 2016, and 2019 On-Premises environments

Impact

Remote attackers can execute arbitrary code with SYSTEM privileges, leading to full server compromise and lateral movement

Mitigation

Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU) and scan for Indicators of Compromise (IoCs)

Affected Products & Version Scope

Microsoft Exchange Server 2013, 2016, and 2019 On-Premises (Exchange Online is not affected)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Verify your current Exchange Server Cumulative Update (CU) level and apply the latest Security Update (SU). Run the following PowerShell commands as Administrator to check your version:

powershell

# Check Exchange Server Version and Build Number
GCI 'HKLM:\Software\Microsoft\ExchangeServer\v15\Setup' | GP | Select-Object AdminDisplayVersion

# Restart IIS Services after applying the official patch
IISReset /noforce

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, implement IIS URL Rewrite rules to block suspicious external requests targeting the OWA authentication paths.

powershell

# Import WebAdministration module and configure URL Rewrite to block unauthorized ASPX writes
Import-Module WebAdministration
$site = 'Default Web Site'
$ruleName = 'Block_External_Exchange_Exploit'
Add-WebConfigurationProperty -pspath 'IIS:\sites\'$site -filter 'system.webServer/rewrite/rules' -name '.' -value @{name=$ruleName;patternSyntax='ECMAScript';stopProcessing='True'}
Set-WebConfigurationProperty -pspath 'IIS:\sites\'$site -filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/match" -name 'url' -value 'owa/auth/.*\.aspx'

3. Log Audit & IoC Verification Commands

Scan the Exchange OWA directories for newly created or modified ASPX files which may indicate web shell deployment.

powershell

# Scan OWA auth directory for ASPX files created or modified in the last 30 days
Get-ChildItem -Path 'C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\' -Filter '*.aspx' | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } | Select-Object FullName, Length, LastWriteTime

# Search HttpProxy logs for suspicious POST requests
Select-String -Path 'C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Owa\*.log' -Pattern 'POST' | Select-Object -First 20

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation in the wild, immediately apply the official Microsoft security updates and perform a thorough compromise assessment.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

CVE-2021-26858 is a critical remote code execution (RCE) vulnerability in Microsoft Exchange Server. The root cause lies in the lack of proper path validation during file write operations within the Exchange server software. This flaw allows an authenticated attacker (or an attacker leveraging an authentication bypass vulnerability) to write arbitrary files to any path on the server.

2. Exploitation Mechanics & Attack Scenario

In real-world campaigns (such as those conducted by the Hafnium threat group), this vulnerability was chained with CVE-2021-26855 (an SSRF vulnerability):

The attacker bypasses authentication using the SSRF vulnerability to gain administrative access to the Exchange backend.
The attacker exploits CVE-2021-26858 to write a malicious ASPX web shell into a web-accessible directory (e.g., '/owa/auth/').
The attacker accesses the web shell remotely to execute arbitrary PowerShell commands, harvest credentials, and compromise the Active Directory domain.

3. Infrastructure & Business Impact

Exchange servers host highly sensitive corporate communications and directory data. Successful exploitation of this vulnerability allows complete domain takeover, data exfiltration, and deployment of ransomware. Given its inclusion in the CISA KEV catalog and an extremely high EPSS score (0.9365), this vulnerability poses an immediate threat to enterprise infrastructure.

Official Vendor Advisories & References

NVD Original English Description

Microsoft Exchange Server Remote Code Execution Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858

Source: secure@microsoft.com · Patch, Vendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858

Source: af854a3a-2127-422b-91ae-364da2661108 · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26858

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2021-26858)

FAQ

Q1. How critical is CVE-2021-26858 and is it actively exploited in the wild?

CVE-2021-26858 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 93.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-26858?

Primary impacted vendors include microsoft across exchange server. Scope summary: Microsoft Exchange Server 2013, 2016, and 2019 On-Premises (Exchange Online is not affected)

Q3. What temporary mitigations or workarounds exist for CVE-2021-26858 before patching?

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (CU) and Security Updates (SU) and scan for Indicators of Compromise (IoCs) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION