CVE-2021-26857 — Security Box Score

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-26857HIGH

Microsoft Exchange Server Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .9401   99.8   YES

AFFECTED
  Product                                              Versions    Fixed
  Microsoft Exchange Server 2010 Service Pack 3        14.0.0.0 –  —
  Microsoft Exchange Server 2013 Cumulative Update 21  15.00.0 –   —
  Microsoft Exchange Server 2013 Cumulative Update 22  15.00.0 –   —
  Microsoft Exchange Server 2013 Cumulative Update 23  15.00.0 –   —
  Microsoft Exchange Server 2013 Service Pack 1        15.00.0 –   —
  Microsoft Exchange Server 2016 Cumulative Update 10  15.01.0 –   —
  Microsoft Exchange Server 2016 Cumulative Update 11  15.01.0 –   —
  Microsoft Exchange Server 2016 Cumulative Update 12  15.01.0 –   —
  Microsoft Exchange Server 2016 Cumulative Update 13  15.01.0 –   —
  Microsoft Exchange Server 2016 Cumulative Update 14  15.01.0 –   —
  + 16 more

TIMELINE
  Feb 8   Reserved by microsoft
  Nov 3   Added to CISA KEV, remediation due 2022-05-03
  Nov 3   Published (CNA: microsoft)

CWE-502 · CNA: microsoft · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due May 3, 2022

Complete event history — 3 events, chronological
Date	Event	Detail
February 8, 2021	Reserved	Reserved by microsoft
November 3, 2021	KEV ADDED	Added to CISA KEV, remediation due 2022-05-03
November 3, 2021	Published	Published (CNA: microsoft)

Complete event history — 3 events, chronological

Date

Event

Detail

February 8, 2021

Reserved

Reserved by microsoft

November 3, 2021

KEV ADDED

Added to CISA KEV, remediation due 2022-05-03

November 3, 2021

Published

Published (CNA: microsoft)

Affected

Affected products and packages — 26 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Microsoft	Microsoft Exchange Server 2010 Service Pack 3	—	14.0.0.0	—
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 21	—	15.00.0	—
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 22	—	15.00.0	—
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 23	—	15.00.0	—
Microsoft	Microsoft Exchange Server 2013 Service Pack 1	—	15.00.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 10	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 11	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 12	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 13	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 14	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 15	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 16	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 17	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 18	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 19	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 8	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 9	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2019	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 1	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 2	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 3	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 4	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 5	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 6	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 7	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 8	—	15.02.0	—

Description

Lifecycle

Affected

Weaknesses

References (3)

Related

About this page