CVE-2021-26858: Microsoft Exchange Server remote code execution flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityThe flaw allows remote code execution on Exchange servers, is listed in CISA KEV with known ransomware use, and has an EPSS probability above 0.93.

What it is

CVE-2021-26858 is a remote code execution vulnerability in Microsoft Exchange Server. The record gives only a one-line description and no root-cause detail, but the flaw is serious because it allows code execution on a mail server, a high-value target holding email and credentials. It is listed in CISA's Known Exploited Vulnerabilities catalog, so it has been exploited in the wild.

Impact

An attacker who successfully exploits the flaw can execute arbitrary code on the Exchange server, gaining control of the host and potentially the mail data and credentials it handles. The CVSS impact ratings for confidentiality, integrity and availability are all high.

Attack surface

The CVSS vector is AV:L/AC:L/PR:N/UI:R, meaning the attack is assessed as local and requires user interaction, with no privileges needed. The description says remote code execution, so the vector and the description do not fully agree; the record does not explain how the flaw is actually reached.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2021-11-03 with a due date of 2022-05-03, and flags known ransomware campaign use. EPSS gives a 30-day exploitation probability of 0.93651 (99.8th percentile), so exploitation is both observed and highly likely.

What to do

• Apply the Microsoft Exchange Server updates referenced in the MSRC advisory for CVE-2021-26858 as the first action.
• If patching cannot be done immediately, isolate or restrict network access to Exchange servers and limit exposure of web and mail interfaces.
• Review Exchange servers for signs of prior compromise, since this CVE is tied to known exploitation and ransomware use.
• Track remediation against the CISA KEV due date of 2022-05-03 and confirm all affected servers are updated.

Detection

• Hunt for unexpected processes or child processes spawned by Exchange server processes such as w3wp.exe.
• Review Exchange and IIS logs for unusual requests or file writes around web-accessible paths.
• Monitor for new or modified files in Exchange web directories and for suspicious scheduled tasks or web shells.
• Alert on outbound connections from Exchange servers to unfamiliar hosts, which can indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.