CVE-2021-26857

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 14 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

44.74%

probability

This CVE has a 44.74% probability of being exploited in the next 30 days.

0% Top 97.6th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Insecure deserialization in the Unifed Messaging service

Attack Intelligence

CWE-502 · Deserialization of Untrusted Data CWE-664 · Improper Control of a Resource Through its Lifetime CWE-913 · Improper Control of Dynamically-Managed Code Resources

Google Project Zero

Patched

March 2, 2021

Reported by

Dubex and Microsoft Threat Intelligence Center (MSTIC)

Root Cause Analysis

???

Exploits & PoC

sirpedrotavares/Proxylogon-exploit

proxylogon exploit - CVE-2021-26857

110

1 repo — triés par ⭐ Rechercher sur GitHub ↗

The Microsoft Exchange hacks: How they started and where we are

BleepingComputer Mar 16, 2021

State hackers rush to exploit unpatched Microsoft Exchange servers

BleepingComputer Mar 03, 2021

Microsoft March 2021 Patch Tuesday fixes 82 flaws, 2 zero-days

BleepingComputer Mar 09, 2021

URGENT — 4 Actively Exploited 0-Day Flaws Found in Microsoft Exchange

TheHackerNews

Microsoft Exchange Server Zero-Days (ProxyLogon) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR

Qualys Mar 03, 2021

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable-Research May 27, 2026

Microsoft fixes actively exploited Exchange zero-day bugs, patch now

BleepingComputer Mar 02, 2021

NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

Qualys Oct 07, 2022

Security Advisory 2021-013

CERT-EU Mar 03, 2021

Qualys Response to CISA Alert: Binding Operational Directive 22-01

Qualys Nov 09, 2021

Top 30 Critical Security Vulnerabilities Most Exploited by Hackers

TheHackerNews

Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries

TheHackerNews

Hackers Target Over 70 Microsoft Exchange Servers to Steal Credentials via Keyloggers

TheHackerNews

CISA Alert: Top Routinely Exploited Vulnerabilities

Qualys Jul 29, 2021

Signal Intelligence

Confidenceⓘ

92%

EPSS 44.74%

Mentions 14

Last Seen May 27, 2026

CNA Information

Analyst Note

CVE-2021-26857 is a confirmed remote code execution vulnerability in Microsoft Exchange Server with a HIGH CVSS score (7.8), inclusion in Google Project Zero research, and validation through CERT-EU security advisory. The zero-day nature and official vendor acknowledgment strongly support the confirmed classification.