CVE-2021-26858
Microsoft Exchange Server 2013 … 2019
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2021-26858 is a high-severity an unspecified weakness vulnerability in Microsoft Exchange Server. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Microsoft Exchange Server is affected by a remote code execution vulnerability tracked as CVE-2021-26858. The flaw received a CVSS 3.1 base score of 7.8 with an attack vector of local access, low attack complexity, no privileges required, and required user interaction, resulting in high impact to confidentiality, integrity, and availability.
An attacker with the ability to interact with a vulnerable system through a local vector can leverage the issue to execute arbitrary code. Because no privileges are needed and complexity is low, successful exploitation grants the attacker full control over affected components without additional authentication.
Microsoft's security advisory and the CISA Known Exploited Vulnerabilities catalog both reference this CVE, indicating that official patches and mitigation guidance are available through the Microsoft Security Response Center. The inclusion in CISA's catalog confirms that the vulnerability has been exploited in real-world attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-13642
Vulnerability Data
Microsoft Exchange Server Remote Code Execution Vulnerability
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
Threat-Actor AttributionAI
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.