CVE-2021-27065

What it actually does

CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Microsoft Exchange Server associated with the ProxyLogon attack chain. After obtaining the ability to authenticate to Exchange as an administrator or SYSTEM-level Exchange context through companion vulnerabilities, an attacker can abuse path traversal behavior to write files to arbitrary locations on the server, most commonly an ASPX web shell under an Exchange-accessible web directory. Successful exploitation can lead to remote code execution, persistent web-based command execution, credential theft, mailbox access, lateral movement, and full compromise of the Exchange host.

Why it matters to the business

Compromise of an Exchange Server can expose corporate email, credentials, address books, attachments, and sensitive business communications, while also giving attackers a foothold into the broader network. This vulnerability is in CISA KEV, has a very high EPSS score, is known to be used in ransomware campaigns, and has been actively exploited for years, so any unpatched or internet-exposed Exchange Server should be treated as high-risk and potentially already compromised.

How an attack unfolds

Attackers typically scan the internet for vulnerable Microsoft Exchange Servers and use CVE-2021-27065 as part of the broader ProxyLogon chain. They first exploit companion Exchange vulnerabilities to gain privileged access or impersonate an authorized Exchange identity, then use the arbitrary file write/path traversal flaw to place a web shell, often an ASPX file, in a web-accessible directory such as the Exchange front-end or inetpub path. Once the web shell is reachable over HTTPS, the attacker sends commands through it to execute code under the web server or Exchange application pool context. From there, they commonly dump credentials, export mailboxes, stage additional tooling, create persistence, move laterally through the Windows domain, and in some incidents deploy ransomware.

How to fix it

Apply the relevant Microsoft Exchange Server security updates for the installed Exchange version and cumulative update level. Because this vulnerability is part of the ProxyLogon exploitation chain, remediate all related March 2021 Exchange vulnerabilities and bring Exchange to a supported cumulative update before applying the latest security update. If immediate patching is not possible, remove external access to Exchange services until patched, restrict access to Exchange endpoints to trusted networks or VPN, and apply Microsoft-recommended mitigations such as IIS URL Rewrite rules only as temporary risk reduction. After patching, assume that vulnerable internet-facing systems may have been compromised: hunt for web shells, rotate credentials, review Exchange configuration, and rebuild from known-good media if compromise is confirmed.

How to confirm the fix worked

Confirm the Exchange Server build and installed security updates using Exchange Management Shell and Microsoft’s published Exchange build matrix. Run Microsoft’s Exchange On-premises Mitigation Tool and Health Checker script where appropriate, and verify that the server is on a supported cumulative update with the applicable security update installed. Validate that internet exposure is limited to required services and that temporary mitigations are not being treated as permanent fixes. Perform file-system and log review for historical compromise, especially if the server was internet-facing before patching.

Typical attack path

1. Identify internet-facing Microsoft Exchange Servers through scanning or reconnaissance.
2. Exploit ProxyLogon-related Exchange vulnerabilities to obtain privileged Exchange access or impersonation capability.
3. Abuse the path traversal/arbitrary file write issue to write an ASPX web shell to a web-accessible directory.
4. Access the web shell over HTTPS and execute commands on the Exchange Server.
5. Run discovery commands, collect credentials, access mailboxes, and stage additional payloads.
6. Establish persistence, move laterally to other Windows systems, and potentially deploy ransomware or exfiltrate data.

How to detect it

Review IIS logs for suspicious POST requests to unusual ASPX files in Exchange or IIS paths, especially requests with short or uncommon filenames, newly created files, or command-like parameters. Inspect Exchange and IIS web directories for unexpected ASPX files, abnormal timestamps, or files written around suspicious OWA/ECP activity. Examine Windows Security, PowerShell, Sysmon, EDR, and antivirus logs for web server worker processes spawning command shells or scripting tools. Key process relationships include w3wp.exe or UMWorkerProcess.exe launching cmd.exe, powershell.exe, cscript.exe, wscript.exe, certutil.exe, bitsadmin.exe, mshta.exe, rundll32.exe, regsvr32.exe, whoami.exe, net.exe, net1.exe, nltest.exe, quser.exe, ipconfig.exe, ping.exe, or archive/exfiltration tools. Check for known ProxyLogon-era web shell names and paths, suspicious mailbox export activity, creation of new local or domain accounts, credential dumping behavior, outbound connections from the Exchange Server to unfamiliar hosts, and ransomware staging. Since exploitation has been widespread and long-running, include historical logs and backups where available, not only current telemetry.

• /aspnet_client/system_web/
• /aspnet_client/system_web/*.aspx
• C:\inetpub\wwwroot\aspnet_client\system_web\
• C:\inetpub\wwwroot\aspnet_client\system_web\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\Current\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\TimeoutLogoff.aspx
• POST /ecp/
• POST /owa/auth/
• POST /aspnet_client/system_web/
• X-AnonResource-Backend
• X-BEResource
• X-CalculatedBETarget
• Set-OabVirtualDirectory
• ExternalUrl
• w3wp.exe cmd.exe
• w3wp.exe powershell.exe
• w3wp.exe cscript.exe
• w3wp.exe wscript.exe
• w3wp.exe certutil.exe
• w3wp.exe bitsadmin.exe
• w3wp.exe mshta.exe
• w3wp.exe rundll32.exe
• UMWorkerProcess.exe cmd.exe
• UMWorkerProcess.exe powershell.exe
• cmd.exe /c whoami
• cmd.exe /c net user
• cmd.exe /c net group
• powershell.exe -enc
• powershell.exe -EncodedCommand
• New-MailboxExportRequest
• Get-MailboxExportRequest
• C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\
• C:\inetpub\logs\LogFiles\W3SVC1\

What your security team should do

• Treat any unpatched or historically exposed Exchange Server as potentially compromised, not merely vulnerable.
• Prioritize immediate patching or isolation because the vulnerability is in CISA KEV, has observed ransomware use, and has extremely high exploitation probability.
• Run Microsoft Exchange Health Checker and security update validation across all Exchange Servers.
• Search for web shells and suspicious ASPX files in Exchange and IIS web directories before and after patching.
• Review IIS, Exchange, Windows Event, PowerShell, and antivirus/EDR logs for exploitation and post-exploitation activity.
• Rotate credentials for Exchange administrators, service accounts, and other privileged accounts if compromise cannot be ruled out.
• Block unnecessary external access to Exchange administrative and web endpoints and require VPN or trusted network access where feasible.
• If web shells or attacker commands are found, perform full incident response including containment, forensic imaging, credential reset, and possible server rebuild.