Vulnerabilities/Microsoft/CVE-2021-26855

CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD9.1Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 3 Nov 2021

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Recommended action

Apply updates per vendor instructions.

CISA due date 3 May 2022 · CWE-918

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
Microsoft Exchange Server 2013 Cumulative Update 2115.00.0 to before 15.00.1395.012Unknown
Microsoft Exchange Server 2013 Cumulative Update 2215.00.0 to before 15.00.1473.006Unknown
Microsoft Exchange Server 2013 Cumulative Update 2315.00.0 to before 15.00.1497.012Unknown
Microsoft Exchange Server 2016 Cumulative Update 1015.01.0 to before 15.01.1531.012Unknown
Microsoft Exchange Server 2016 Cumulative Update 1115.01.0 to before 15.01.1591.018Unknown
Show 19 more rows
Microsoft Exchange Server 2016 Cumulative Update 1215.01.0 to before 15.01.1713.010Unknown
Microsoft Exchange Server 2016 Cumulative Update 1315.01.0 to before 15.01.1779.008Unknown
Microsoft Exchange Server 2016 Cumulative Update 1415.01.0 to before 15.01.1847.012Unknown
Microsoft Exchange Server 2016 Cumulative Update 1515.01.0 to before 15.01.1913.012Unknown
Microsoft Exchange Server 2016 Cumulative Update 1615.01.0 to before 15.01.1979.008Unknown
Microsoft Exchange Server 2016 Cumulative Update 1715.01.0 to before 15.01.2044.013Unknown
Microsoft Exchange Server 2016 Cumulative Update 1815.01.0 to before 15.01.2106.013Unknown
Microsoft Exchange Server 2016 Cumulative Update 1915.01.0 to before 15.01.2176.009Unknown
Microsoft Exchange Server 2016 Cumulative Update 815.01.0 to before 15.01.1415.010Unknown
Microsoft Exchange Server 2016 Cumulative Update 915.01.0 to before 15.01.1466.016Unknown
Microsoft Exchange Server 201915.02.0 to before 15.02.0221.018Unknown
Microsoft Exchange Server 2019 Cumulative Update 115.02.0 to before 15.01.1979.006Unknown
Microsoft Exchange Server 2019 Cumulative Update 215.02.0 to before 15.02.0397.011Unknown
Microsoft Exchange Server 2019 Cumulative Update 315.02.0 to before 15.02.0464.015Unknown
Microsoft Exchange Server 2019 Cumulative Update 415.02.0 to before 15.02.0659.012Unknown
Microsoft Exchange Server 2019 Cumulative Update 515.02.0 to before 15.02.0595.008Unknown
Microsoft Exchange Server 2019 Cumulative Update 615.02.0 to before 15.02.0529.013Unknown
Microsoft Exchange Server 2019 Cumulative Update 715.02.0 to before 15.02.0721.013Unknown
Microsoft Exchange Server 2019 Cumulative Update 815.02.0 to before 15.02.0792.010Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 3 Nov 2021 · Added to CISA KEV
  • 3 May 2022 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.