CVE-2021-26857: Microsoft Exchange Server deserialization flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: medium.

critical priorityIt is in CISA KEV with known ransomware campaign use and has an EPSS probability above 0.95, so exploitation is both confirmed and highly likely.

What it is

CVE-2021-26857 is a deserialization of untrusted data (CWE-502) vulnerability in Microsoft Exchange Server that can lead to remote code execution. The CVSS 3.1 vector is local with user interaction required, yet the record is tracked as a remote code execution issue and is listed in CISA KEV, so the practical reach may be broader than the base vector suggests. It matters because Exchange is widely exposed and the flaw is confirmed as exploited in the wild.

Impact

An attacker who can trigger the vulnerable deserialization path can execute code in the context of the Exchange service, potentially gaining control of the mail server. CISA KEV notes known ransomware campaign use, so compromise can escalate to broader network impact.

Attack surface

The CVSS vector is AV:L/AC:L/PR:N/UI:R, meaning the base metric describes local access with no privileges but requiring user interaction; the description calls it remote code execution, so the exact remote reach is not fully specified in this record. No authentication is required per the vector, but user interaction is.

Exploitation

CISA KEV lists it as known exploited with a 2021-11-03 addition date and known ransomware campaign use, and EPSS 30-day probability is 0.95762 (99.87th percentile), indicating very high likelihood of exploitation activity.

What to do

• Apply the Microsoft Exchange security updates referenced in the MSRC advisory for CVE-2021-26857 immediately.
• Prioritize patching any internet-facing Exchange servers and verify patch level against the vendor update guide.
• Restrict external exposure of Exchange services (OWA, ECP, Autodiscover) where operationally feasible.
• Review Exchange server logs and host telemetry for signs of compromise given known ransomware use.
• Follow CISA KEV required action: apply updates per vendor instructions by the listed due date.

Detection

• Hunt for suspicious w3wp.exe or Exchange worker process spawning child processes such as cmd.exe, powershell.exe, or net.exe.
• Monitor for unexpected deserialization-related activity or anomalous .NET process behavior on Exchange hosts.
• Review IIS and Exchange logs for unusual POST requests to Exchange endpoints around the time of suspected exploitation.
• Correlate host telemetry with known post-exploitation behavior associated with Exchange server compromises.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.