IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.8Hoch KEV In Ransomware genutzt

CVE-2021-26858Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 21; Microsoft Microsoft Exchange Server 2013 Cumulative Update 22; Microsoft Microsoft Exchange Serv… Veröffentlicht: (vor 5 Jahren)

Bekannt ausgenutzt — Microsoft Exchange Server Remote Code Execution Vulnerability

CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26858

Beschreibung

Microsoft Exchange Server Remote Code Execution Vulnerability

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
microsoft exchange server 15.02.0 – < 15.02.0221.018
Microsoft Microsoft Exchange Server 2013 Cumulative Update 21 15.00.0 – < 15.00.1395.012
Microsoft Microsoft Exchange Server 2013 Cumulative Update 22 15.00.0 – < 15.00.1473.006
Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 15.00.0 – < 15.00.1497.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 10 15.01.0 – < 15.01.1531.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 11 15.01.0 – < 15.01.1591.018
Microsoft Microsoft Exchange Server 2016 Cumulative Update 12 15.01.0 – < 15.01.1713.010
Microsoft Microsoft Exchange Server 2016 Cumulative Update 13 15.01.0 – < 15.01.1779.008
Microsoft Microsoft Exchange Server 2016 Cumulative Update 14 15.01.0 – < 15.01.1847.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 15 15.01.0 – < 15.01.1913.012
Microsoft Microsoft Exchange Server 2016 Cumulative Update 16 15.01.0 – < 15.01.1979.008
Microsoft Microsoft Exchange Server 2016 Cumulative Update 17 15.01.0 – < 15.01.2044.013
Microsoft Microsoft Exchange Server 2016 Cumulative Update 18 15.01.0 – < 15.01.2106.013
Microsoft Microsoft Exchange Server 2016 Cumulative Update 19 15.01.0 – < 15.01.2176.009
Microsoft Microsoft Exchange Server 2016 Cumulative Update 8 15.01.0 – < 15.01.1415.010
Microsoft Microsoft Exchange Server 2016 Cumulative Update 9 15.01.0 – < 15.01.1466.016
Microsoft Microsoft Exchange Server 2019 15.02.0 – < 15.02.0221.018
Microsoft Microsoft Exchange Server 2019 Cumulative Update 1 15.02.0 – < 15.01.1979.006
Microsoft Microsoft Exchange Server 2019 Cumulative Update 2 15.02.0 – < 15.02.0397.011
Microsoft Microsoft Exchange Server 2019 Cumulative Update 3 15.02.0 – < 15.02.0464.015
Microsoft Microsoft Exchange Server 2019 Cumulative Update 4 15.02.0 – < 15.02.0659.012
Microsoft Microsoft Exchange Server 2019 Cumulative Update 5 15.02.0 – < 15.02.0595.008
Microsoft Microsoft Exchange Server 2019 Cumulative Update 6 15.02.0 – < 15.02.0529.013
Microsoft Microsoft Exchange Server 2019 Cumulative Update 7 15.02.0 – < 15.02.0721.013
Microsoft Microsoft Exchange Server 2019 Cumulative Update 8 15.02.0 – < 15.02.0792.010

Referenzen und Patches

CPE-Treffer (NVD) (24)
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_21:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_22:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*

Neue CVEs im selben Produkt — Microsoft Exchange Server

9.3Kritisch
CVE-2026-70279

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

1.3%EPSS
8.1Hoch
CVE-2026-70571

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

1.4%EPSS
8.8Hoch
CVE-2026-77910

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

7.8Hoch
CVE-2026-87692

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server Subscription Edition RTM

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

2.3%EPSS
7.8Hoch
CVE-2026-87695

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

7.5Hoch
CVE-2026-87696

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.