CVE-2021-26412

mediumpriority · track · 38EPSS 0.338 · 98 %ileEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

33.8% (98th) EPSS

CVSS 6.5 · medium

Is it mine?

23 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · msrc_csaf

EPSS · scored 2026-10-27

Microsoft Exchange Server Remote Code Execution Vulnerability

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedMicrosoft Exchange Server 2013 Cumulative Update 23msrc_csaf
15.00.1497.012:Security Update:https://support.microsoft.com/help/5000871
https://support.microsoft.com/help/5000871
FixedMicrosoft Exchange Server 2016 Cumulative Update 18msrc_csaf
15.01.2106.013:Security Update:https://support.microsoft.com/help/5000871
https://support.microsoft.com/help/5000871
FixedMicrosoft Exchange Server 2016 Cumulative Update 19msrc_csaf
15.01.2176.009:Security Update:https://support.microsoft.com/help/5000871
https://support.microsoft.com/help/5000871
FixedMicrosoft Exchange Server 2019 Cumulative Update 7msrc_csaf
15.02.0721.013:Security Update:https://support.microsoft.com/help/5000871
https://support.microsoft.com/help/5000871
FixedMicrosoft Exchange Server 2019 Cumulative Update 8msrc_csaf
15.02.0792.010:Security Update:https://support.microsoft.com/help/5000871
https://support.microsoft.com/help/5000871

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.5–9.1

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8 · impact 6.4

v2.05.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)

v3.19.1criticalAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 2.3 · impact 6

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Microsoft Security Response Center US

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 1.2 · impact 5.9

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20US

affected products (23)

Products and version ranges known to be affected.

Microsoft Microsoft Exchange Server 2013 Cumulative Update 2315.00.0 → publicationenisa_euvdEU
Microsoft Microsoft Exchange Server 2016 Cumulative Update 1815.01.0 → publicationenisa_euvdEU
Microsoft Microsoft Exchange Server 2016 Cumulative Update 1915.01.0 → publicationenisa_euvdEU
Microsoft Microsoft Exchange Server 2019 Cumulative Update 715.02.0 → publicationenisa_euvdEU
Microsoft Microsoft Exchange Server 2019 Cumulative Update 815.02.0 → publicationenisa_euvdEU
Microsoft Corp Microsoft Exchange Server≤ 2016 Cumulative Update 19fstec_bduRU
Microsoft Corp Microsoft Exchange Server≤ 2019 Cumulative Update 8fstec_bduRU
Microsoft Corp Microsoft Exchange Server≤ 2019 Cumulative Update 7fstec_bduRU
Microsoft Corp Microsoft Exchange Server≤ 2016 Cumulative Update 18fstec_bduRU
Microsoft Corp Microsoft Exchange Server≤ 2013 Cumulative Update 23fstec_bduRU
Microsoft Exchange Server 2013 Cumulative Update 23all versionsfixedmsrc_csafUS
Microsoft Exchange Server 2013 Cumulative Update 23< 15.00.1497.012msrc_csafUS
Microsoft Exchange Server 2016 Cumulative Update 18all versionsfixedmsrc_csafUS
Microsoft Exchange Server 2016 Cumulative Update 18< 15.01.2106.013msrc_csafUS
Microsoft Exchange Server 2016 Cumulative Update 19all versionsfixedmsrc_csafUS
Microsoft Exchange Server 2016 Cumulative Update 19< 15.01.2176.009msrc_csafUS
Microsoft Exchange Server 2019 Cumulative Update 7all versionsfixedmsrc_csafUS
Microsoft Exchange Server 2019 Cumulative Update 7< 15.02.0721.013msrc_csafUS
Microsoft Exchange Server 2019 Cumulative Update 8all versionsfixedmsrc_csafUS
Microsoft Exchange Server 2019 Cumulative Update 8< 15.02.0792.010msrc_csafUS

showing 20 of 23

advisories (1)

Vendor and ecosystem advisories describing this.

msrc_CVE-2021-26412Microsoft Exchange Server Remote Code Execution Vulnerability2021-03-02csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu msrc_csaf NVD CVE.org MITRE

published 2021-03-03modified 2026-08-19

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan