Microsoft Exchange Server ProxyLogon CVE-2021-26855 (unauthenticated SSRF chained into remote code execution, mass-exploited, CISA KEV): which Exchange builds need which update and what if the server was exposed unpatched?

What it is: CVE-2021-26855 is a server-side request forgery flaw in on-premises Microsoft Exchange Server that lets an outside attacker send requests that the server treats as trusted, with no login. Chained with related bugs fixed in the same release (CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) it leads to code execution and web shells on the server. Microsoft disclosed it in early March 2021 after exploitation by a state-linked group, and many other actors, including ransomware crews, followed within days. It is in CISA's KEV catalog (added 2021-11-03) and old unpatched Exchange servers still get probed. Am I affected: - On-premises Exchange Server 2013, 2016 and 2019 (2010 received a defense-in-depth update). Which build you run matters, because the March 2021 security update only installs on certain cumulative updates. - Per CISA's guidance, the update required Exchange 2013 CU 23, 2016 CU 19 or CU 18, and 2019 CU 8 or CU 7. Older CUs must be upgraded first. - Check the build with Get-ExchangeServer | Format-List Name,AdminDisplayVersion in the Exchange Management Shell. Fix: 1. Move every Exchange server to a currently supported cumulative update with the latest security updates. Exchange 2013 and earlier are out of support, so migrate rather than patch in place. 2. Run patches from an elevated prompt, as Microsoft's notes require, otherwise they can install incompletely. 3. Temporary mitigations Microsoft published (such as URL rewrite rules and disabling certain services) are stopgaps only; do not leave an unpatched server reachable from the internet. 4. If the server was reachable and unpatched in or after March 2021, assume compromise. Use Microsoft's published detection scripts and guidance to look for web shells in Exchange web directories, unexpected scheduled tasks, new accounts, and mailbox export or credential-dumping activity. Remediate by rebuilding the server, not just deleting files, then reset passwords for administrators and service accounts and review Active Directory for persistence. Verify: AdminDisplayVersion shows a patched supported build on every server, Microsoft's detection script reports no findings, and Exchange services (OWA, ECP) are not exposed directly to the internet without a hardened front end. Sources: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a https://nvd.nist.gov/vuln/detail/CVE-2021-26855 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855