CVE-2021-26855: Microsoft Exchange — Web Shell Compromise Risk (June 2024)

CVE-2021-26855 — Microsoft Exchange

CVE-2021-26855 is a high-severity vulnerability in Microsoft Exchange Server that allows unauthenticated attackers to perform remote code execution via crafted HTTP requests. The vulnerability is actively exploited in the wild, with incidents confirmed as recently as June 2024. Attackers leverage this flaw to deploy web shells and gain persistent access to compromised environments.

Attack Vector

Attackers exploit CVE-2021-26855 by sending specially crafted requests to vulnerable Exchange servers, bypassing authentication and executing arbitrary commands. Indicators of compromise include unexpected web shell files and malicious HTTP traffic. The NCSC Early Warning service has detected related malicious activity and issued vulnerability notifications, enabling affected organizations to respond before further escalation.

Who Is at Risk

All organizations running unpatched Microsoft Exchange Server—especially those in the UK—are at risk. The NCSC has confirmed that various UK organizations, including suppliers, have been targeted. Both on-premises and hybrid Exchange deployments are vulnerable if not updated with the latest security patches.

Patch & Mitigate

• Patch: Apply the latest Microsoft Exchange Server security updates immediately. Microsoft has released dedicated patches for CVE-2021-26855; do not delay.
• Workaround: If patching is not immediately possible, restrict external HTTP(S) access to Exchange servers and monitor for unauthorized access.
• Detect: Review server logs for anomalous HTTP requests, creation of unexpected web shell files, and alerts from the NCSC Early Warning service.

MITRE ATT&CK

• TA0011 — Command and Control: Attackers use web shells for persistent remote access and control post-exploitation.
• TA0025 — Initial Access: Exploitation of public-facing applications to gain a foothold in the target environment.

Source: https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning