EXPOSURES › CVE-2021-26858
CVE-2021-26858
CRITICAL ⌖ ON CISA KEV · EXPLOITEDMicrosoft Exchange Server vulnerabilities allowed attackers to execute code remotely, often as part of ransomware attacks.
CVE-2021-26858, part of the ProxyLogon exploit chain, enabled remote code execution on vulnerable Microsoft Exchange Servers. DIB organizations using unpatched Exchange Servers faced significant exposure, potential compliance failures (CMMC/NIST 800-171), and risk of data breach. Immediate patching and vulnerability scanning are critical.
Shame score — The widespread exploitation of a critical RCE vulnerability in a widely-used enterprise product, linked to ransomware, reflects significant negligence in Microsoft's security practices.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain."
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |