CVE-2021-26855: Microsoft Exchange Server SSRF enabling remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE in widely deployed Exchange Server, actively exploited in KEV with ransomware use and near-certain EPSS probability.

What it is

CVE-2021-26855 is a server-side request forgery (CWE-918) in Microsoft Exchange Server that is part of the ProxyLogon exploit chain and can lead to remote code execution. It is remotely reachable without authentication or user interaction, making it a high-value target for mass exploitation.

Impact

An unauthenticated attacker can forge server-side requests to reach internal Exchange endpoints, which in the ProxyLogon chain enables arbitrary file write and remote code execution on the mail server.

Attack surface

Reached over the network via the Exchange web interface (AV:N, PR:N, UI:N), requiring no credentials or user action. The record does not list specific affected Exchange versions or build numbers.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is 0.99996 (99.988th percentile); multiple public exploit references exist.

What to do

• Apply the Microsoft Exchange security updates referenced in the vendor advisory and MSRC update guide immediately.
• If patching cannot be completed at once, isolate or restrict external access to Exchange OWA/ECP endpoints and apply vendor-provided mitigations.
• Hunt for and remediate any prior compromise, since ProxyLogon exploitation often includes web shells and credential theft.
• Rotate credentials and review Exchange service accounts after patching, as the chain can expose mailbox data and authentication material.

Detection

• Monitor Exchange IIS logs for suspicious POST requests to /owa/auth/logon.aspx and unusual /ecp/ or /autodiscover/ paths.
• Search for unexpected .aspx files in Exchange OWA and ECP directories that may indicate web shells.
• Alert on outbound or internal HTTP requests originating from Exchange servers to unusual destinations consistent with SSRF.
• Review Exchange servers for anomalous process creation or child processes spawned by w3wp.exe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.