CVE-2021-26855

9.1
CRITICALCVSS v3.1 Base Score
100.00%
HIGH RiskEPSS (100th percentile)
KEV
CWE-918

Microsoft Exchange Server Remote Code Execution Vulnerability

Published: 3/3/2021
Modified: 8/19/2026
Back to CVE Lookup

ACTIVELY EXPLOITED IN THE WILD

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Vulnerability Name:

Microsoft Exchange Server Remote Code Execution Vulnerability

Vendor / Product:

Microsoft Exchange Server

Required Action:

Apply updates per vendor instructions.

Due Date: 5/3/2022(OVERDUE)
Ransomware Campaign Use
Added to KEV:

11/3/2021

Notes:

Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26855

View CISA KEV Catalog

Vulnerability Summary

CVSS v3 Score

9.1CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2 Score

7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Score (Exploitation Probability)

100.00%HIGH Exploitation Risk
100th percentile

This vulnerability has a 100.00% probability of being exploited in the next 30 days, ranking higher than 100% of all scored CVEs.

CWE Classification

CWE-918

Learn More

CVSS Calculator

View this score breakdown or calculate a custom score

Understanding CVSS Scoring

Learn how severity scores are calculated and what they mean

CVE Prioritization Guide

Best practices for deciding which vulnerabilities to address first

What is a CVE?

Essential guide to Common Vulnerabilities and Exposures

CVE vs CWE Explained

Understand how CVEs relate to underlying weakness types

Advertisement