CVE-2021-26858

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 14 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

79.97%

probability

This CVE has a 79.97% probability of being exploited in the next 30 days.

0% Top 99.1th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Arbitrary file write

Google Project Zero

Patched

March 2, 2021

Reported by

Microsoft Threat Intelligence Center

Root Cause Analysis

???

The Microsoft Exchange hacks: How they started and where we are

BleepingComputer Mar 16, 2021

State hackers rush to exploit unpatched Microsoft Exchange servers

BleepingComputer Mar 03, 2021

Microsoft March 2021 Patch Tuesday fixes 82 flaws, 2 zero-days

BleepingComputer Mar 09, 2021

URGENT — 4 Actively Exploited 0-Day Flaws Found in Microsoft Exchange

TheHackerNews

Microsoft Exchange Server Zero-Days (ProxyLogon) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR

Qualys Mar 03, 2021

Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersect

Tenable-Research May 27, 2026

Microsoft fixes actively exploited Exchange zero-day bugs, patch now

BleepingComputer Mar 02, 2021

NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

Qualys Oct 07, 2022

Security Advisory 2021-013

CERT-EU Mar 03, 2021

Qualys Response to CISA Alert: Binding Operational Directive 22-01

Qualys Nov 09, 2021

Top 30 Critical Security Vulnerabilities Most Exploited by Hackers

TheHackerNews

Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries

TheHackerNews

Hackers Target Over 70 Microsoft Exchange Servers to Steal Credentials via Keyloggers

TheHackerNews

CISA Alert: Top Routinely Exploited Vulnerabilities

Qualys Jul 29, 2021

Signal Intelligence

Confidenceⓘ

92%

EPSS 79.97%

Mentions 14

Last Seen May 27, 2026

CNA Information

Analyst Note

CVE-2021-26858 is a confirmed zero-day in Microsoft Exchange Server 2019 with HIGH severity (CVSS 7.8) and documented RCE capability, corroborated by Google Project Zero research and CERT-EU security advisory. The vulnerability has sufficient evidence of active exploitation and technical validation to warrant high confidence in its confirmed status.