CVE-2021-26857: Microsoft Exchange Server Remote Code Execution Vulnerability

1. In CISA KEVCISA KEV catalogue3 Nov 2021
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not established: not seen

DescriptionCVE.org

Microsoft Exchange Server Remote Code Execution Vulnerability

• Microsoft · Microsoft Exchange Server 2010 Service Pack 3from 14.0.0.0 before 14.03.0513.000
• Microsoft · Microsoft Exchange Server 2013 Cumulative Update 21from 15.00.0 before 15.00.1395.012
• Microsoft · Microsoft Exchange Server 2013 Cumulative Update 22from 15.00.0 before 15.00.1473.006
• Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23from 15.00.0 before 15.00.1497.012
• Microsoft · Microsoft Exchange Server 2013 Service Pack 1from 15.00.0 before 15.00.0847.064
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 10from 15.01.0 before 15.01.1531.012
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 11from 15.01.0 before 15.01.1591.018
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 12from 15.01.0 before 15.01.1713.010
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 13from 15.01.0 before 15.01.1779.008
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 14from 15.01.0 before 15.01.1847.012
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 15from 15.01.0 before 15.01.1913.012
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 16from 15.01.0 before 15.01.1979.008
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 17from 15.01.0 before 15.01.2044.013
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 18from 15.01.0 before 15.01.2106.013
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 19from 15.01.0 before 15.01.2176.009
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 8from 15.01.0 before 15.01.1415.010
• Microsoft · Microsoft Exchange Server 2016 Cumulative Update 9from 15.01.0 before 15.01.1466.016
• Microsoft · Microsoft Exchange Server 2019from 15.02.0 before 15.02.0221.018
• Microsoft · Microsoft Exchange Server 2019 Cumulative Update 1from 15.02.0 before 15.01.1979.006
• Microsoft · Microsoft Exchange Server 2019 Cumulative Update 2from 15.02.0 before 15.02.0397.011

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.

CISA KEV

Listed since 3 Nov 2021 · known ransomware use · catalogue entry

Public check

No public nuclei template

Weakness

Deserialization of Untrusted Data · Deserialization and Object Injection

Vendor

Microsoft

Published

March 2021

Band

Exploited in the wild, March 2021

1. 5 Nov
   CISA’s KEV entry now notes known ransomware use CISA
2. 3 Nov 2021
   CISA added it to the KEV catalogue CISA

• NVD entrynvd.nist.gov
• CISA KEV cataloguecisa.gov
• CVE recordcve.org
• Weakness CWE-502cwe.mitre.org
• Vendor advisorymsrc.microsoft.com
• portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2portal.msrc.microsoft.com