What happened
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Affected versions
Exchange Server: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
Exploit-DB 49663Microsoft Exchange 2019 - Server-Side Request ForgeryF52021-03-14VerifiedExploit-DB 49637Microsoft Exchange 2019 - Server-Side Request Forgery (Proxylogon) (PoC)testanull2021-03-11VerifiedExploit-DB 49879Microsoft Exchange 2019 - Unauthenticated Email DownloadGonzalo Villegas2021-05-18VerifiedExploit-DB 49895Microsoft Exchange 2019 - Unauthenticated Email Download (Metasploit)mekhalleh2021-05-21VerifiedSploitusExploit for CVE-2021-26855 and CVE-2021-27065. CVSS 9.8.Sploitus index2026-09-23T04:55:10+00:00CandidatePoC-in-GitHub · sgnls/exchange-0days-202103IoC determination for exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.★ 5sgnls2021-03-03CandidatePoC-in-GitHub · soteria-security/HAFNIUM-IOCA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865★ 22soteria-security2021-03-03CandidatePoC-in-GitHub · cert-lv/exchange_webshell_detectionDetect webshells dropped on Microsoft Exchange servers exploited through "proxylogon" group of vulnerabilites (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)★ 98cert-lv2021-03-05CandidatePoC-in-GitHub · conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855Microsoft Exchange Server SSRF漏洞(CVE-2021-26855)★ 36conjojo2021-03-06CandidatePoC-in-GitHub · pussycat0x/CVE-2021-26855-SSRFThis script helps to identify CVE-2021-26855 ssrf Poc★ 24pussycat0x2021-03-06CandidatePoC-in-GitHub · La3B0z/CVE-2021-26855-SSRF-ExchangeCVE-2021-26855 SSRF Exchange Server★ 6La3B0z2021-03-07CandidatePoC-in-GitHub · mekhalleh/exchange_proxylogonModule pack for #ProxyLogon (part. of my contribute for Metasploit-Framework) [CVE-2021-26855 && CVE-2021-27065]★ 4mekhalleh2021-03-07CandidatePoC-in-GitHub · Yt1g3r/CVE-2021-26855_SSRFPOC of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865, ProxyLogon poc★ 4Yt1g3r2021-03-08CandidatePoC-in-GitHub · hackerxj007/CVE-2021-26855CVE-2021-26855 exp★ 5hackerxj0072021-03-08CandidatePoC-in-GitHub · dwisiswant0/proxylogscanA fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin (CVE-2021-26855).★ 166dwisiswant02021-03-08CandidatePoC-in-GitHub · mauricelambert/ExchangeWeaknessTestThis script test the CVE-2021-26855 vulnerability on Exchange Server.★ 0mauricelambert2021-03-09CandidatePoC-in-GitHub · DCScoder/Exchange_IOC_HunterCVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065★ 0DCScoder2021-03-09CandidatePoC-in-GitHub · srvaccount/CVE-2021-26855-PoCPoC exploit code for CVE-2021-26855★ 17srvaccount2021-03-09CandidatePoC-in-GitHub · h4x0r-dz/CVE-2021-26855★ 98h4x0r-dz2021-03-09CandidatePoC-in-GitHub · alt3kx/CVE-2021-26855_PoC★ 53alt3kx2021-03-10CandidatePoC-in-GitHub · r0xDB/CVE-2021-26855CVE-2021-26855, also known as Proxylogon, is a server-side request forgery (SSRF) vulnerability in Exchange that allows an attacker to send arbitrary HTTP requests and authenticate as the Exchange server.★ 12r0xDB2021-03-11CandidatePoC-in-GitHub · hackerschoice/CVE-2021-26855PoC of proxylogon chain SSRF(CVE-2021-26855) to write file by testanull, censored by github★ 59hackerschoice2021-03-11CandidatePoC-in-GitHub · SCS-Labs/HAFNIUM-Microsoft-Exchange-0dayCVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065★ 5SCS-Labs2021-03-11CandidatePoC-in-GitHub · KotSec/CVE-2021-26855-ScannerScanner and PoC for CVE-2021-26855★ 3KotSec2021-03-12CandidatePoC-in-GitHub · hakivvi/proxylogonRCE exploit for Microsoft Exchange Server (CVE-2021-26855).★ 22hakivvi2021-03-14CandidatePoC-in-GitHub · ZephrFish/Exch-CVE-2021-26855CVE-2021-26855: PoC (Not a HoneyPoC for once!)★ 28ZephrFish2021-03-14CandidatePoC-in-GitHub · mil1200/ProxyLogon-CVE-2021-26855RCE exploit for ProxyLogon vulnerability in Microsoft Exchange★ 9mil12002021-03-14CandidatePoC-in-GitHub · evilashz/ExchangeSSRFtoRCEExploitCVE-2021-26855 & CVE-2021-27065★ 28evilashz2021-03-15CandidatePoC-in-GitHub · ZephrFish/Exch-CVE-2021-26855_Privpatched to work★ 4ZephrFish2021-03-15CandidatePoC-in-GitHub · Mr-xn/CVE-2021-26855-d★ 6Mr-xn2021-03-15CandidatePoC-in-GitHub · RickGeex/ProxyLogonProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability, CVE-2021-27065, to get code execution.★ 33RickGeex2021-03-16CandidatePoC-in-GitHub · Immersive-Labs-Sec/ProxyLogonChaining CVE-2021-26855 and CVE-2021-26857 to exploit Microsoft Exchange★ 3Immersive-Labs-Sec2021-03-16CandidatePoC-in-GitHub · TaroballzChen/ProxyLogon-CVE-2021-26855-metasploitCVE-2021-26855 proxyLogon metasploit exploit script★ 4TaroballzChen2021-03-17CandidatePoC-in-GitHub · p0wershe11/ProxyLogonProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE(SSRF->GetWebShell)★ 123p0wershe112021-03-17CandidatePoC-in-GitHub · antichown/Scan-Vuln-CVE-2021-26855★ 0antichown2021-03-18CandidatePoC-in-GitHub · catmandx/CVE-2021-26855-Exchange-RCEMicrosoft Exchange Proxylogon Exploit Chain EXP分析★ 0catmandx2021-03-21CandidatePoC-in-GitHub · hictf/CVE-2021-26855-CVE-2021-27065analytics ProxyLogo Mail exchange RCE★ 0hictf2021-03-23CandidatePoC-in-GitHub · praetorian-inc/proxylogon-exploitProof-of-concept exploit for CVE-2021-26855 and CVE-2021-27065. Unauthenticated RCE in Exchange.★ 52praetorian-inc2021-03-24CandidatePoC-in-GitHub · Flangvik/SharpProxyLogonC# POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode injection★ 247Flangvik2021-03-29CandidatePoC-in-GitHub · haotiku/CVE-2021-26855-exploit-Exchange★ 0haotiku2021-04-14CandidatePoC-in-GitHub · hosch3n/ProxyVulns[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [ProxyShell] CVE-2021-34473 & CVE-2021-34523 & CVE-2021-31207 Exploit Chains.★ 176hosch3n2021-04-14CandidatePoC-in-GitHub · Nick-Yin12/106362522針對近期微軟公布修補遭駭客攻擊的Exchange Server漏洞問題，台灣DEVCORE表示早在1月5日便已發現安全漏洞後，並且向微軟通報此項編號命名為「CVE-2021-26855 」，以及「CVE-2021-27065」的零日漏洞，同時也將此項漏洞稱為「ProxyLogon」。 此次揭露的「ProxyLogon」漏洞，是以無需驗證即可使用的遠端程式碼執行 (Pre-Auth Remote Code Execution；Pre-Auth RCE)零日漏洞(Zero-day exploit)，可讓攻擊者得以繞過身份驗證步驟，驅使系統管理員協助執行惡意文件或執行指令，進而觸發更廣泛的攻擊。 「ProxyLogon」是微軟近期被揭露最重大的RCE漏洞之一，DEVCORE團隊遵循責任揭露 (Responsible Disclosure)原則，在發現後便第一時間立即於今年1月5日通報微軟進行修補，避免該漏洞遭有心人士利用，造成全球用戶重大損失。而微軟遂於3月2日針對相關漏洞釋出安全更新，避免用戶機敏資訊遭受惡意攻擊。個人想法:遭駭客攻擊的Exchange Server漏洞問題，台灣DEVCORE表示早在1月5日便已發現，並且向微軟通報此項編號命名為「CVE-2021-26855 」，以及「CVE-2021-27065」的零日漏洞，同時也將此項漏洞稱為「ProxyLogon」。 此次揭露的「ProxyLogon」漏洞，是以無需驗證即可使用的遠端程式碼執行 (Pre-Auth Remote Code Execution；Pre-Auth RCE)零日漏洞(Zero-day exploit)，可讓攻擊者得以繞過身份驗證步驟，驅使系統管理員協助執行惡意文件或執行指令，進而觸發更廣泛的攻擊。 「ProxyLogon」是微軟近期被揭露最重大的RCE漏洞之一，DEVCORE團隊遵循責任揭露 (Responsible Disclosure)原則，在發現後便第一時間立即於今年1月5日通報微軟進行修補，避免該漏洞遭有心人士利用，造成全球用戶重大損失。而微軟遂於3月2日針對相關漏洞釋出安全更新，避免用戶機敏資訊遭受惡意攻擊。個人想法:微軟是大眾常用的軟體之一，駭客只要察覺漏洞就會進行惡意的攻擊，微軟公布4個Exchange Server的安全漏洞後，就遭受駭客的惡意攻擊，這件事的發生，微軟需更加小心並提高資安的防護。★ 0Nick-Yin122021-04-19CandidatePoC-in-GitHub · yaoxiaoangry3/FlangvikC# POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode in…★ 0yaoxiaoangry32021-10-30CandidatePoC-in-GitHub · thau0x01/poc_proxylogonMicrosoft Exchange ProxyLogon PoC (CVE-2021-26855)★ 8thau0x012021-12-04CandidatePoC-in-GitHub · 1342486672/FlangvikC# POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode in…★ 013424866722022-06-07CandidatePoC-in-GitHub · kh4sh3i/ProxyLogonProxyLogon (CVE-2021-26855+CVE-2021-27065) Exchange Server RCE (SSRF->GetWebShell)★ 9kh4sh3i2022-06-27CandidatePoC-in-GitHub · wysssadda/ExchangeSmashCVE-2021-26855★ 0wysssadda2022-06-27CandidatePoC-in-GitHub · byinarie/ZirconiumTool to search for IOCs related to HAFNIUM: CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065★ 2byinarie2023-01-22CandidatePoC-in-GitHub · ssrsec/Microsoft-Exchange-RCEMicrosoft Exchange CVE-2021-26855&CVE-2021-27065★ 3ssrsec2023-02-02CandidatePoC-in-GitHub · glen-pearson/ProxyLogon-CVE-2021-26855★ 1glen-pearson2023-04-23CandidatePoC-in-GitHub · ShyTangerine/cve-2021-26855★ 0ShyTangerine2023-04-25CandidatePoC-in-GitHub · timb-machine-mirrors/testanull-CVE-2021-26855_read_poc.txtClone from gist★ 0timb-machine-mirrors2024-01-04CandidatePoC-in-GitHub · Wercd/CVE-2021-26855★ 0Wercd2025-12-04CandidatePoC-in-GitHub · SimoesCTT/CTT-ProxyLogon-RCE-v1.0---Convergent-Time-Theory-Enhanced-Microsoft-Exchange-ExploitAn advanced exploit for Microsoft Exchange Server (CVE-2021-26855, CVE-2021-27065) enhanced with Convergent Time Theory principles, achieving near-perfect theoretical rating through quantum temporal resonance and α-dispersion techniques.★ 0SimoesCTT2026-01-27CandidatePoC-in-GitHub · SimoesCTT/CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-26855-CVE-2021-27065CTT-enhanced version of the Microsoft Exchange Server SSRF to RCE exploit (ProxyShell/ProxyLogon), another CVSS 10.0 critical vulnerability that affected hundreds of thousands of organizations worldwide.★ 1SimoesCTT2026-01-28CandidatePoC-in-GitHub · probablysecure/Triage-CVE-2021-26855-ProxyLogon---Microsoft-Exchange-Goal is to triage well known attacks and learn how security teams quickly respond.★ 0probablysecure2026-06-29CandidateSploitusExploit for CVE-2021-26855 and CVE-2021-27065. CVSS 9.8.Sploitus index2026-10-03T08:15:30+00:00CandidateSploitusRCE exploit script for ProxyLogon (CVE-2021-26855) in Microsoft Exchange using Python 3.9.KitPloit2026-10-05T13:02:24Candidatekitploit.comRCE exploit script for ProxyLogon (CVE-2021-26855) in Microsoft Exchange using Python 3.9.ru2026-10-05T13:02:24CandidateSource timeline
Discovered through CISA Known Exploited VulnerabilitiesView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.