CVE-2021-26857: Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-26857 is a remote code execution vulnerability in Microsoft Exchange Server. It is part of the ProxyLogon exploit chain and has been used by ransomware operators, so unpatched servers face a realistic risk of full compromise.

IT and security teams should treat this as a high-priority item: confirm whether Exchange is in your environment, apply the vendor updates, and watch for signs of prior abuse. Specifics such as exact builds and patch identifiers must be confirmed against the Microsoft advisory.

How it works

The weakness is classified as CWE-502 (Deserialization of Untrusted Data). In products that accept serialized objects from the network or from other components, an attacker who can supply crafted input may cause the application to reconstruct objects in an unsafe way. When that reconstruction triggers attacker-controlled code paths, the result can be remote code execution in the context of the Exchange process.

Public detail on the precise trigger for CVE-2021-26857 is limited beyond the fact that it enables remote code execution and sits in the ProxyLogon chain. Defenders should assume that a remote attacker who can reach the vulnerable Exchange endpoint can achieve code execution if the server is unpatched. Do not rely on unconfirmed exploit write-ups; validate behavior and indicators against the vendor advisory and your own telemetry.

Am I affected? How to find it in your systems

Microsoft Exchange Server typically runs on Windows servers inside the organization or in hosted environments that you manage. Inventory every host that provides mailbox, Client Access, or related Exchange roles.

• Enumerate Exchange servers via your CMDB, Active Directory, configuration-management tools, or by scanning for hosts listening on common Exchange/HTTPS ports and confirming the product.
• Record the installed Exchange build and cumulative update level on each server and compare it to the fixed versions listed in the Microsoft advisory for CVE-2021-26857.
• Note whether the server is internet-facing or reachable from untrusted networks; exposure increases urgency but internal-only servers remain in scope.
• Review IIS and Exchange logs, Windows Security and System events, and EDR telemetry for unusual process creation under Exchange worker processes, unexpected w3wp.exe or UM-related activity, new or altered ASPX/ASHX files under Exchange install paths, and authentication or deserialization-related errors around the time of suspected scanning.
• If you have network or WAF logs, look for anomalous requests consistent with ProxyLogon-style chains; treat any confirmed hit as a potential compromise until proven otherwise.

When version or configuration details are unclear, treat the server as potentially affected until you have verified it against the vendor advisory.

How to remediate

Patching is the primary fix. Apply the Microsoft updates that address CVE-2021-26857 on every affected Exchange Server, following the vendor’s installation order and prerequisites. CISA’s required action is to apply updates per vendor instructions; schedule this as an emergency change if the servers are reachable from untrusted networks.

• After patching, reboot if required and confirm the new build number matches the fixed release.
• Re-enable or tighten any temporary hardening you applied only after the patch is verified.
• For this class of flaw, reduce the attack surface: limit which interfaces accept untrusted serialized or complex input, run Exchange services with least privilege where supported, and keep the underlying OS and IIS fully patched.
• Ensure centralized logging and EDR coverage remain on Exchange hosts so post-patch monitoring is effective.

If you can't patch immediately

If you must delay the update, reduce exposure until the patch can be installed.

• Segment Exchange servers so only required management and client subnets can reach them; block direct internet access to administrative or vulnerable endpoints where possible.
• Place a WAF or reverse proxy in front of Outlook Web App and other HTTPS front ends and enable rules that inspect or block known ProxyLogon-related request patterns; treat this as virtual patching, not a permanent substitute.
• Disable or restrict any non-essential Exchange features or roles that are not required for business operations, after confirming impact with your messaging team.
• Increase monitoring: alert on new web shells, unexpected child processes of Exchange/IIS workers, scheduled-task or service creation, and outbound connections from Exchange hosts to unfamiliar destinations.
• Restrict administrative access to jump hosts with MFA and just-in-time privileges, and ensure backups of mail databases and server configuration are current and tested.

These steps lower risk but do not eliminate it; schedule the official update as soon as practicable.

If your data may have been exposed

Actively exploited vulnerabilities, including those used by ransomware, frequently lead to data theft or follow-on intrusion. If logs or EDR indicate exploitation, or if the server was internet-facing and unpatched during the relevant window, initiate your incident-response process: isolate affected hosts, preserve evidence, reset privileged credentials, and assess mail and file data for exfiltration.

You can also run a free exposure scan of your email addresses against known breach data to see whether associated accounts have appeared in prior dumps, then enforce password changes and MFA where needed.