EPSS
Percentile
100.0%
Added: 03/19/2021
Microsoft Exchange is an e-mail server for Microsoft Windows operating systems.
A server-side request forgery vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary commands.
Apply the patch referenced in Microsoft Advisory CVE-2021-26855.
<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855>
<https://proxylogon.com/>
Exploit requires knowledge of an e-mail address on the target mail server.
Exploit creates a web shell in \Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\test11.aspx
which must be manually removed after a successful exploit.
Windows
EPSS
Percentile
100.0%