CVE-2021-27065: Microsoft Exchange Server path traversal leading to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: medium.

critical priorityIt is in CISA KEV with known ransomware use, has near-certain EPSS probability, and public exploit code exists, making unpatched Exchange servers an immediate compromise risk.

What it is

CVE-2021-27065 is a path traversal (CWE-22) flaw in Microsoft Exchange Server that allows an attacker to write files to arbitrary locations, which can be leveraged to achieve remote code execution. It is part of the ProxyLogon exploit chain and is listed in CISA's Known Exploited Vulnerabilities catalog, so it matters to any organization still running unpatched Exchange.

Impact

An attacker can write attacker-controlled files to arbitrary paths on the Exchange server and execute code, gaining a foothold with the privileges of the Exchange service. CISA records known ransomware campaign use, so a successful compromise can escalate to broader network intrusion and ransomware deployment.

Attack surface

The CVSS vector is AV:L/PR:N/UI:R, indicating the flaw is reached locally with no privileges but requires user interaction; the description and ProxyLogon references indicate the Exchange web-facing service is the practical entry point. No authentication is required per the vector, but the record does not detail the exact request path.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and EPSS is 0.99876 (99.963rd percentile), so exploitation is effectively certain. Public exploit code is referenced on Packet Storm, confirming weaponized availability.

What to do

• Apply the Microsoft Exchange security updates referenced in the MSRC advisory immediately.
• Run the Microsoft Exchange On-Premises Mitigation Tool or the ProxyLogon detection script to find and remediate compromised servers.
• Isolate or rebuild any Exchange server showing indicators of compromise before returning it to service.
• Restrict external access to Exchange OWA/ECP endpoints until patching is complete.
• Rotate credentials and review for persistence mechanisms after patching, since exploitation may have already occurred.

Detection

• Hunt for suspicious file writes to Exchange web directories (e.g., aspnet_client, owa, ecp) outside normal deployment windows.
• Monitor for w3wp.exe spawning child processes such as cmd.exe, powershell.exe, or net.exe.
• Review Exchange logs for anomalous ECP/OWA requests matching known ProxyLogon patterns.
• Alert on creation of webshell-like files (.aspx, .ashx) in Exchange virtual directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.