CVE-2021-26858

What it actually does

CVE-2021-26858 is a Microsoft Exchange Server remote code execution vulnerability involving improper handling of files by Exchange components. Although the CVSS vector records local access and user interaction, in real-world Exchange compromise chains this issue was used after an attacker had already obtained a foothold or administrative capability through other Exchange vulnerabilities, allowing arbitrary file write and subsequent execution paths. Successful exploitation can let an attacker place malicious files such as web shells or tooling on the Exchange server, leading to execution of attacker-controlled code with high confidentiality, integrity, and availability impact.

Why it matters to the business

A compromised Exchange server can expose corporate email, credentials, address books, attachments, and sensitive business communications, and can also become a launch point for broader domain compromise. This vulnerability is in CISA KEV, has a high EPSS score, has been actively exploited in the wild, and is associated with ransomware activity, so unpatched or historically exposed Exchange servers should be treated as high-priority incident-response concerns, not just routine patching items. Operational consequences may include email outage, data theft, ransomware deployment, regulatory notification, and costly forensic recovery.

How an attack unfolds

An attacker typically targets an internet-facing Microsoft Exchange Server and first gains access through an initial Exchange compromise path, credential abuse, or another vulnerability in the Exchange attack chain. Once they can interact with vulnerable local Exchange functionality or write to relevant paths, they abuse CVE-2021-26858 to place attacker-controlled content on the server. The dropped content is commonly a web shell or supporting payload that gives persistent remote command execution through the web server. From there, the attacker enumerates mailboxes, exports email, harvests credentials, disables defenses, deploys additional tools, moves laterally, and in some campaigns stages ransomware. Because this vulnerability was part of broad Exchange exploitation activity, organizations should assume exploitation may have occurred before patching if the server was internet-facing during the exposure window.

How to fix it

Apply all relevant Microsoft Exchange Server security updates for the installed Exchange versions, including the March 2021 and later cumulative/security updates that addressed the ProxyLogon-era Exchange vulnerabilities. Because no specific fixed versions were provided, use Microsoft’s current Exchange Server Health Checker and official Exchange update guidance to identify the required supported cumulative update and latest security update for each server. If immediate patching is not possible, restrict inbound access to Exchange administrative and web endpoints to trusted networks or VPN, remove direct internet exposure where feasible, enable or verify Exchange Emergency Mitigation Service protections on supported versions, and apply Microsoft-recommended URL Rewrite/IIS mitigations only as temporary controls. Patching alone does not remove web shells, stolen credentials, or attacker persistence; perform compromise assessment and rotate credentials if exposure existed before remediation.

How to confirm the fix worked

Confirm each Exchange server is on a supported cumulative update with the latest security update installed by using Microsoft Exchange Health Checker, Exchange Management Shell version checks, and Windows installed update inventory. Verify that the server no longer matches vulnerable build numbers and that Exchange/IIS services restarted cleanly after patching. Validate external exposure by scanning from an untrusted network for Exchange OWA/ECP/Autodiscover endpoints and confirming only intended access paths are reachable. Search Exchange and IIS web directories for unauthorized ASPX/ASHX files, confirm file integrity against known-good baselines, and review Microsoft Safety Scanner, Exchange On-premises Mitigation Tool, Defender, or EDR results. Where practical, run a controlled vulnerability scan or vendor-provided Exchange vulnerability assessment to confirm the issue is no longer exploitable.

Typical attack path

1. Identify internet-facing Microsoft Exchange Server instances and determine whether they are vulnerable or historically exposed.
2. Gain an initial foothold or required execution context through an Exchange exploit chain, credential compromise, or other access path.
3. Abuse the arbitrary file write/code execution condition to write attacker-controlled files to Exchange or IIS-accessible locations.
4. Deploy a web shell or payload, commonly under an ASPX filename, to obtain persistent remote command execution.
5. Run discovery commands, enumerate mailboxes, collect credentials, and stage additional post-exploitation tooling.
6. Exfiltrate email and sensitive files, move laterally to other systems, and attempt privilege escalation.
7. Optionally deploy ransomware or destructive payloads after data theft and domain-wide access are achieved.

How to detect it

Investigate historical exploitation using IIS logs from Exchange front-end and back-end sites, Exchange application logs, Windows Security logs, PowerShell operational logs, Sysmon or EDR telemetry, antivirus detections, and filesystem metadata in Exchange web directories. Focus on evidence of unexpected ASPX web shells, anomalous POST requests to OWA/ECP/Autodiscover paths, suspicious access to newly created files under Exchange or IIS virtual directories, and unusual command execution spawned by IIS worker processes. Look for w3wp.exe launching cmd.exe, powershell.exe, net.exe, whoami.exe, nltest.exe, dsquery.exe, certutil.exe, bitsadmin.exe, rundll32.exe, or archive/exfiltration tools. Review mailbox export activity, new or modified Exchange roles, suspicious RBAC changes, unauthorized admin logins, and unexplained outbound connections from Exchange servers. Because this flaw was exploited in broader Exchange campaigns and ransomware intrusions, also hunt for persistence mechanisms such as scheduled tasks, services, startup entries, credential-dumping artifacts, and ransomware staging files. Absence of a single known web shell name is not sufficient; attackers frequently used randomized filenames and placed shells in multiple Exchange-accessible directories.

• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning powershell_ise.exe
• w3wp.exe spawning net.exe
• w3wp.exe spawning whoami.exe
• w3wp.exe spawning nltest.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning rundll32.exe
• /owa/auth/
• /ecp/
• /ecp/default.aspx
• /autodiscover/autodiscover.json
• POST /owa/auth/
• POST /ecp/
• POST /aspnet_client/
• C:\inetpub\wwwroot\aspnet_client\
• C:\inetpub\wwwroot\aspnet_client\system_web\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp\
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\owa\auth\
• *.aspx created under C:\inetpub\wwwroot\aspnet_client\
• *.aspx created under C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\
• aspnet_client\system_web\*.aspx
• China Chopper
• eval(Request.Item[
• System.Web.HttpRequest
• Page_Load
• New-MailboxExportRequest
• Set-OabVirtualDirectory
• MSExchange Management Event ID 1
• PowerShell Event ID 4104
• Sysmon Event ID 1
• Windows Security Event ID 4688

What your security team should do

• Treat any internet-facing Exchange server that was unpatched during the 2021 exploitation window as potentially compromised and perform incident-response triage, not only patch verification.
• Immediately apply the latest supported Exchange cumulative update and security update across all Exchange servers, including hybrid servers not used for mailbox hosting.
• Use Microsoft Exchange Health Checker and vendor vulnerability scanners to inventory Exchange builds, exposed endpoints, and missing security updates.
• Hunt for web shells, suspicious ASPX files, abnormal IIS requests, unexpected child processes of w3wp.exe, and post-exploitation tooling on all Exchange servers.
• Review IIS, Exchange, Windows Security, PowerShell, Sysmon, EDR, and proxy logs for activity around the period when the server was vulnerable or exposed.
• Rotate credentials for Exchange service accounts, administrators, and any accounts suspected of mailbox access or credential dumping after exposure.
• Isolate or rebuild servers where web shells, unknown binaries, or attacker persistence are found; do not rely on deleting a single file as complete remediation.
• Restrict direct internet access to Exchange management surfaces and require VPN, conditional access, MFA, and least-privilege administration where applicable.
• Prioritize remediation because the vulnerability is listed in CISA KEV, had a 2022-05-03 federal remediation deadline, has high exploit probability, and has been associated with ransomware campaigns.