{"uuid": "8bdcaa8e-a5bb-4804-b421-f60cd6fd0439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27065", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_proxylogon_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x64, x86, cmd\", \"author\": [\"Orange Tsai\", \"Jang ( \", \"mekhalleh (RAMELLA S\\u00e9bastien)\", \"print(\\\"\\\")\", \"lotusdll\", \"Praetorian\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploit a vulnerability on Microsoft Exchange Server that\\n          allows an attacker bypassing the authentication, impersonating as the\\n          admin (CVE-2021-26855) and write arbitrary file (CVE-2021-27065) to get\\n          the RCE (Remote Code Execution).\\n\\n          By taking advantage of this vulnerability, you can execute arbitrary\\n          commands on the remote Microsoft Exchange Server.\\n\\n          This vulnerability affects (Exchange 2013 Versions < 15.00.1497.012,\\n          Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009,\\n          Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010).\\n\\n          All components are vulnerable by default.\", \"disclosure_date\": \"2021-03-02\", \"fullname\": \"exploit/windows/http/exchange_proxylogon_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Microsoft Exchange ProxyLogon RCE\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"ProxyLogon\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/exchange_proxylogon_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/exchange_proxylogon_rce\", \"references\": [\"CVE-2021-26855\", \"CVE-2021-27065\", \"LOGO-https://proxylogon.com/images/logo.jpg\", \"URL-https://proxylogon.com/\", \"URL-http://aka.ms/exchangevulns\", \"URL-https://www.praetorian.com/blog/reproducing-proxylogon-exploit\", \"URL-https://testbnull.medium.com/ph%C3%A2n-t%C3%ADch-l%E1%BB%97-h%E1%BB%95ng-proxylogon-mail-exchange-rce-s%E1%BB%B1-k%E1%BA%BFt-h%E1%BB%A3p-ho%C3%A0n-h%E1%BA%A3o-cve-2021-26855-37f4b6e06265\", \"URL-https://www.o2oxy.cn/3169.html\", \"URL-https://github.com/praetorian-inc/proxylogon-exploit\", \"URL-https://github.com/Zeop-CyberSec/proxylogon_writeup\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Windows Powershell\", \"Windows Dropper\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:47.216969Z"}