CVE-2021-27065

CVE-2021-27065 is a remote code execution vulnerability in on-premises Microsoft Exchange Server, best known as the file-write component of the ProxyLogon exploit chain disclosed in March 2021. The flaw lets an attacker write arbitrary files, such as web shells, to the Exchange web server, and when chained with the pre-authentication SSRF bug in the same ProxyLogon chain it yields fully unauthenticated code execution on the server. Successful exploitation gives attackers the ability to run commands as the Exchange server, access organizational email and data, establish persistence, and — as CISA notes — it has been used as a foothold for ransomware deployment. Any organization running an affected on-premises Exchange Server is exposed, particularly when Outlook Web Access or other Exchange endpoints are internet-reachable; this is a server-product flaw, not an Exchange Online/cloud-mailbox issue. Exploitation is confirmed and widespread: it is in the wild with known ransomware use, CISA added it to the KEV on 2021-11-03, and EPSS assigns a ~99.9% probability of exploitation within 30 days.

What to do: Apply Microsoft's March 2021 (or later) Exchange Server security updates immediately, consistent with CISA's required action to apply vendor updates. Hunt for ProxyLogon indicators — web shells under the Exchange FrontEnd HttpProxy folders (e.g., in owa/auth), unexpected files in the OAB virtual directory, and ransomware artifacts — using Microsoft's Safety Scanner or the Test-ProxyLogon tooling, and treat any hit as a full intrusion (scope persistence and rotate exposed credentials). If patching must be deferred, restrict or remove internet exposure of OWA/ECP and apply interim mitigations while monitoring for ransomware deployment.