CVE-2021-26858

Deeper analysis

Microsoft Exchange Server is affected by a remote code execution vulnerability tracked as CVE-2021-26858. The flaw received a CVSS 3.1 base score of 7.8 with an attack vector of local access, low attack complexity, no privileges required, and required user interaction, resulting in high impact to confidentiality, integrity, and availability.

An attacker with the ability to interact with a vulnerable system through a local vector can leverage the issue to execute arbitrary code. Because no privileges are needed and complexity is low, successful exploitation grants the attacker full control over affected components without additional authentication.

Microsoft's security advisory and the CISA Known Exploited Vulnerabilities catalog both reference this CVE, indicating that official patches and mitigation guidance are available through the Microsoft Security Response Center. The inclusion in CISA's catalog confirms that the vulnerability has been exploited in real-world attacks.