CVE-2021-26857

What it actually does

CVE-2021-26857 is a deserialization vulnerability in Microsoft Exchange Server. When an attacker can cause Exchange to process maliciously crafted serialized data in the vulnerable component, the server may instantiate attacker-controlled objects and execute code with the privileges of the Exchange service context. Although the CVSS vector indicates local attack complexity characteristics involving user interaction, this flaw was part of the broader 2021 Exchange exploitation chain and can enable full confidentiality, integrity, and availability compromise once the attacker has a foothold or can reach the vulnerable execution path.

Why it matters to the business

Successful exploitation can give an attacker control over a Microsoft Exchange server, exposing email, credentials, address books, attachments, and internal communications. Because Exchange commonly has privileged network access and sensitive data, compromise can lead to business email compromise, lateral movement, data theft, service disruption, and ransomware deployment. This vulnerability is listed in CISA KEV, has a very high EPSS score, is known to have been exploited in the wild, and has been associated with ransomware activity, so unpatched systems should be treated as high-priority incident-response candidates rather than routine patching items.

How an attack unfolds

An attacker first identifies an exposed or reachable Microsoft Exchange Server and looks for evidence that it has not received the security updates addressing the 2021 Exchange vulnerabilities. In real-world campaigns, this vulnerability was commonly used with other Exchange weaknesses to obtain access, bypass controls, or reach the vulnerable code path. After the attacker can influence the deserialization flow, they provide crafted serialized content that Exchange processes unsafely, resulting in code execution under the Exchange service account. From there, the attacker may deploy web shells, run discovery commands, dump credentials, access mailboxes, create persistence, move laterally to domain resources, exfiltrate data, or stage ransomware.

How to fix it

Apply the applicable Microsoft Exchange Server security updates that address the March 2021 Exchange vulnerabilities and all subsequent cumulative and security updates for the deployed Exchange version. If exact fixed build numbers are not already tracked, use Microsoft’s official Exchange Server Health Checker script and Microsoft Security Update Guide to confirm the required cumulative update and security update level for each supported Exchange release. Remove unsupported Exchange versions from production, as they may not receive complete protection. If immediate patching is not possible, restrict access to Exchange administrative and service endpoints, place Exchange behind strong authentication and network controls where supported, block unnecessary inbound access, and increase monitoring; however, mitigation should be considered temporary and not a substitute for patching. Because this vulnerability is KEV-listed and associated with ransomware activity, systems that were exposed while vulnerable should also undergo compromise assessment, not just patching.

How to confirm the fix worked

Confirm the installed Exchange build includes the Microsoft security updates released for the March 2021 Exchange vulnerabilities or later superseding updates. Run the Microsoft Exchange Server Health Checker script and verify it reports the server as current for its supported cumulative update branch. Validate that all Exchange roles and servers in the organization are patched, including hybrid, management, and standby systems. Check that unsupported Exchange versions have been upgraded or decommissioned. Perform authenticated version checks where possible rather than relying only on network banners. After patching, review web directories, Exchange logs, Windows Event Logs, IIS logs, scheduled tasks, services, and startup locations for signs of compromise that may have occurred before remediation.

Typical attack path

1. Identify internet-facing or internally reachable Microsoft Exchange Server instances.
2. Fingerprint Exchange version and patch level to determine whether March 2021 or later security updates are missing.
3. Use the vulnerability as part of an Exchange exploit chain or after initial foothold to reach the unsafe deserialization path.
4. Submit malicious serialized data that is processed by the vulnerable Exchange component.
5. Achieve code execution in the Exchange service context.
6. Deploy post-exploitation tooling such as web shells, command execution stagers, credential dumpers, or remote access payloads.
7. Access mailboxes and Exchange data, harvest credentials, and enumerate Active Directory.
8. Move laterally to additional systems or escalate privileges.
9. Exfiltrate sensitive data and, in some campaigns, deploy ransomware or destructive payloads.

How to detect it

Hunt for evidence of exploitation across IIS logs, Exchange HTTP proxy logs, Exchange application logs, Windows Security logs, PowerShell logs, Sysmon or EDR telemetry, antivirus alerts, and file-system artifacts in Exchange web directories. Because this vulnerability was used in broader Exchange exploitation campaigns, do not look for a single log line only; correlate suspicious requests to Exchange endpoints with web shell creation, abnormal child processes from w3wp.exe or UMWorkerProcess.exe, encoded PowerShell, credential access, mailbox export activity, and lateral movement. Review the period from initial public disclosure through the patch date, and include any systems that were exposed before the CISA KEV remediation deadline. Look for ASPX files with unusual names or recent modification times under Exchange Client Access paths, unexpected command execution by IIS or Exchange worker processes, suspicious PowerShell spawned from Exchange services, archive or exfiltration tooling, new scheduled tasks or services, and authentication from unusual IP addresses. If ransomware indicators are present, preserve forensic images and logs before containment where feasible.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• UMWorkerProcess.exe spawning cmd.exe
• UMWorkerProcess.exe spawning powershell.exe
• powershell.exe -enc
• powershell.exe -EncodedCommand
• /aspnet_client/system_web/
• C:\inetpub\wwwroot\aspnet_client\system_web\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• /ecp/
• /owa/auth/
• POST /ecp/
• POST /owa/auth/
• Set-MpPreference -DisableRealtimeMonitoring $true
• procdump.exe -ma lsass.exe
• rundll32.exe comsvcs.dll, MiniDump
• schtasks /create
• certutil.exe -urlcache -split -f

What your security team should do

• Treat any internet-facing Exchange server that was unpatched after public disclosure as potentially compromised and initiate threat hunting.
• Prioritize remediation immediately due to CISA KEV listing, known exploitation in the wild, very high EPSS probability, and ransomware association.
• Patch Exchange to a supported cumulative update and latest security update level across all servers, not only externally exposed systems.
• Run Microsoft Exchange Health Checker and Microsoft-provided Exchange on-premises mitigation and scanning tools where applicable.
• Search for web shells, suspicious ASPX files, abnormal PowerShell execution, credential dumping activity, and unexpected child processes spawned by Exchange or IIS worker processes.
• Review mailbox access, administrator actions, new role assignments, transport rule changes, and suspicious authentication patterns following the exposure window.
• Rotate credentials for accounts with Exchange or domain privileges if compromise is suspected or confirmed.
• Restrict inbound access to Exchange management interfaces and administrative endpoints to trusted networks or VPNs.
• Ensure EDR, PowerShell logging, IIS logging, and Windows event collection are enabled and retained long enough to cover the exposure period.
• Prepare ransomware response actions, including backup validation and isolation procedures, for any Exchange host with evidence of post-exploitation activity.