Patchfirst
Patchfirst
CVE-2021-26858 KEVRansomware High · 7.8 EPSS 93.7%

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft · Exchange Server

Summary

An attacker who can get a user to interact with a crafted element, such as opening a malicious file or link, can execute code, requiring local access with no privileges needed and user interaction on the victim's side.

Heading is the official description · NVD
Breakdown
81.2 / 100
Exploited
Yes, in CISA KEV
Reports
3
Tactics
1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. What they do

First seen exploited 1 day before it was disclosed.

  1. First seen exploitedVulnCheck KEV evidence1 day before
  2. Disclosedday 0
  3. Added to CISA KEVknown ransomware use; EU database agrees+8 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

1 , grouped by in kill-chain order, 1 cited passage 1

PersistenceTA0003

Web Shell T1505.003 Medium
MITRE CTID mapping of the KEV entry · primary impact

CVE-2021-26858, part of Proxy Logon, is a post-authentication arbitrary file write vulnerability in Exchange. CVE-2021-26858 and CVE-2021-27065 are similar post-authentication arbitrary write file vulnerabilities in Exchange. An attacker, authenticated either by using CVE-2021-26855 or via stolen admin credentials, could write a file to any path on the server.

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit

Detection

2 rules for this CVE · 35 general rules for its techniques

Rules for this CVE

2 that reference CVE-2021-26858 directly.

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Web ShellT1505.00335 general rules
All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 3 threat reports
3 reportsCISANCSC UKi.blackhat.com

Reports are matched by finding the exact id CVE-2021-26858 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag

Vendor Advisory 2

msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26858
↑ ↓ chooseEnter openEsc close