CVE-2021-26855

Actively exploited

CISA lists CVE-2021-26855 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Exchange Server.

• Apply updates per vendor instructions.

Public exploit: Cataloged public exploit.

• Rapid7 Metasploit: Microsoft Exchange ProxyLogon RCE (2026-09-23 21:40:29.350562+00)

  Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

• Exploit-DB: Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC) (2026-09-23 21:40:27.335989+00)

  Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.

• Exploit-DB: Microsoft Exchange 2019 - Server-Side Request Forgery (2026-09-23 21:40:27.335989+00)

  Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.

• Exploit-DB: Microsoft Exchange 2019 - Unauthenticated Email Download (2026-09-23 21:40:27.335989+00)

  Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.

• Exploit-DB: Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit) (2026-09-23 21:40:27.335989+00)

  Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.