Overview
What is CVE-2021-27065?
Microsoft Exchange Server Remote Code Execution Vulnerability
Source: NVD
CISA says:Apply updates per vendor instructions.CISA catalog due date May 3, 2022
CVE intelligenceCISA KEVRansomware use
CVE-2021-27065
Microsoft Exchange Server Remote Code Execution Vulnerability
7.8HIGHCVSS out of 10
What this means
Actively exploited
CISA lists CVE-2021-27065 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Exchange Server.
- Apply updates per vendor instructions.
Public exploit: Cataloged public exploit.
- Rapid7 Metasploit: Microsoft Exchange ProxyLogon RCE (2026-09-23 21:40:29.350562+00)
Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.
- Exploit-DB: Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC) (2026-09-23 21:40:27.335989+00)
Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.
CISA KEVListedObserved exploitation
EPSS99.9%Estimated 30-day exploitation probability
Ransomware useReported by CISACISA KEV ransomware field
Threat actors1Source-linked actor relationships