CVE-2021-27065: Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-27065 is a remote code execution vulnerability in Microsoft Exchange Server. It forms part of the ProxyLogon exploit chain and can let an attacker run code on the server. Public reporting and CISA note that it has been used in ransomware activity, so unpatched Exchange instances remain a high-priority risk for mail infrastructure and the data it holds.

Defenders should treat any internet-facing or internally reachable Exchange deployment as in scope until they confirm the vendor’s fixed builds are installed. Specifics on exact builds and attack prerequisites must be taken from Microsoft’s advisory rather than secondary summaries.

How it works

The weakness is recorded as CWE-39. In practical terms this class of flaw lets an attacker influence path handling so that crafted input reaches a sensitive file-system or request-processing path the application did not intend to expose. When chained with the other ProxyLogon components, the result is remote code execution on the Exchange server itself.

An attacker who can reach the vulnerable endpoint sends specially formed requests that abuse the path-handling defect. Successful abuse yields the ability to write or execute code in the context of the Exchange process. The CISA summary describes the vulnerability as unspecified beyond remote code execution and its membership in the ProxyLogon chain; therefore operators should not rely on incomplete public technical write-ups and should instead validate behavior and indicators against the official vendor advisory.

Am I affected? How to find it in your systems

Microsoft Exchange Server commonly runs on Windows Server hosts that provide corporate email, calendaring and related services. It may be deployed on-premises, in hybrid configurations, or as part of larger messaging farms. Inventory every server that hosts the Exchange role, including edge, mailbox and client-access functions.

• Enumerate installed Exchange builds and cumulative updates via PowerShell (Get-ExchangeServer, Get-Command exsetup) or the Exchange Admin Center; compare the results with the fixed versions listed in Microsoft’s advisory for CVE-2021-27065.
• Identify any servers still reachable from untrusted networks, especially those exposing Outlook Web App, Exchange Web Services or related virtual directories.
• Review IIS and Exchange protocol logs for anomalous POST or path-traversal-style requests targeting Exchange endpoints around the time of known ProxyLogon activity; look for unexpected file writes under the Exchange install path or IIS web roots.
• Cross-check EDR or file-integrity alerts for new or modified ASPX, config or binary files that appeared without a change ticket.

If version or configuration data is unclear, treat the host as potentially vulnerable until the vendor advisory confirms otherwise.

How to remediate

Apply the security updates Microsoft released for this CVE exactly as directed in the vendor advisory. CISA’s required action is simply to apply those updates per vendor instructions. After patching, reboot if required and verify the new build numbers.

• Prioritize internet-facing and hybrid Exchange servers, then internal-only hosts.
• Confirm that all cumulative updates and any prerequisite fixes named by Microsoft are present; partial patching can leave residual exposure inside the ProxyLogon chain.
• Once patched, rotate any credentials or certificates that may have been exposed, and re-baseline file-system and web-root integrity checks.
• Harden remaining attack surface by disabling unused Exchange virtual directories, enforcing modern authentication, and restricting administrative access to jump hosts.

If you can't patch immediately

When immediate patching is impossible, reduce exposure with layered compensating controls while the update is scheduled.

• Segment Exchange hosts so that only necessary management and client subnets can reach them; block direct internet access to the vulnerable endpoints wherever feasible.
• Apply temporary WAF or reverse-proxy rules that reject malformed path or traversal patterns associated with this class of flaw; tune rules against Microsoft’s guidance to avoid breaking legitimate traffic.
• Disable or restrict any non-essential Exchange features or virtual directories that the advisory indicates are involved.
• Increase monitoring: forward IIS, Exchange and Windows security logs to a SIEM, alert on anomalous process creation from the Exchange worker processes, and watch for ransomware precursor behaviors such as mass file encryption or unusual PowerShell.
• Ensure offline, immutable backups of mail databases and system state exist and have been tested.

These measures buy time but do not replace the vendor update.

If your data may have been exposed

Actively exploited remote-code-execution flaws on mail servers frequently lead to data theft, persistence and ransomware. If exploitation is suspected, isolate the host, preserve volatile evidence, and begin incident-response procedures including credential resets and mail-flow review. Organizations and individuals can also run a free exposure scan of their email addresses against known breach data sets to determine whether related accounts have already appeared in public dumps.