Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-26858

CVE-2021-26858HIGH

Microsoft Exchange Server Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .9365   99.8   YES

AFFECTED
  Product                                              Versions   Fixed
  Microsoft Exchange Server 2013 Cumulative Update 21  15.00.0 –  —
  Microsoft Exchange Server 2013 Cumulative Update 22  15.00.0 –  —
  Microsoft Exchange Server 2013 Cumulative Update 23  15.00.0 –  —
  Microsoft Exchange Server 2016 Cumulative Update 10  15.01.0 –  —
  Microsoft Exchange Server 2016 Cumulative Update 11  15.01.0 –  —
  Microsoft Exchange Server 2016 Cumulative Update 12  15.01.0 –  —
  Microsoft Exchange Server 2016 Cumulative Update 13  15.01.0 –  —
  Microsoft Exchange Server 2016 Cumulative Update 14  15.01.0 –  —
  Microsoft Exchange Server 2016 Cumulative Update 15  15.01.0 –  —
  Microsoft Exchange Server 2016 Cumulative Update 16  15.01.0 –  —
  + 14 more

TIMELINE
  Feb 8   Reserved by microsoft
  Nov 3   Added to CISA KEV, remediation due 2022-05-03
  Nov 3   Published (CNA: microsoft)

CNA: microsoft · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due May 3, 2022

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
February 8, 2021	Reserved	Reserved by microsoft
November 3, 2021	KEV ADDED	Added to CISA KEV, remediation due 2022-05-03
November 3, 2021	Published	Published (CNA: microsoft)

Affected

Affected products and packages — 24 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 21	—	15.00.0	—
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 22	—	15.00.0	—
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 23	—	15.00.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 10	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 11	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 12	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 13	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 14	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 15	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 16	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 17	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 18	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 19	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 8	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 9	—	15.01.0	—
Microsoft	Microsoft Exchange Server 2019	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 1	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 2	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 3	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 4	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 5	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 6	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 7	—	15.02.0	—
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 8	—	15.02.0	—

References (3)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858 [Patch, Vendor Advisory]
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26858 [Patch, Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26858 [US Government Resource]

Authoritative record: CVE-2021-26858 at cve.org

Vendors: microsoft

About this page