IRONSMITHINTEL
CRITICALCVSS9.8
|
Actively Exploited
|CISA KEV|CVE-2021-26855|Auth: none — unauthenticated|Reboot: service restart|Est. 2 hours including service restart and verification|Manual only

KB5000871: Microsoft Exchange Server 2013 / 2016 / 2019 Security Update (March 2021)

Pre-authentication RCE on on-premises Exchange. Chaining these four CVEs allows unauthenticated attackers to read email and install backdoors. Apply KB5000871 — this was exploited by Hafnium and at least 10 other APT groups within days of disclosure.

Published Mar 2, 2021 · Updated May 29, 2026
XLinkedIn
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

An unauthenticated attacker can read all email on the Exchange server, dump credentials, install persistent web shells, and move laterally to the rest of the network. CISA confirmed exploitation by nation-state actors against US government agencies. The attack requires only HTTPS access to Exchange — no credentials, no phishing.

How the attack worksNo clicks needed

Exchange's Outlook Web Access and Exchange Control Panel expose HTTP endpoints that fail to validate authentication properly (CVE-2021-26855 — SSRF). Chained with three post-auth vulnerabilities, an attacker can achieve unauthenticated remote code execution and write web shells to disk.

📧

Phishing link

→

🖼

Malicious file

🔓

Server compromised

Am I affected?Quick check

Probably yes if any of these apply:

●On-premises Microsoft Exchange Servers
●Internet-facing OWA/ECP endpoints
●Hybrid Exchange deployments
●Running Exchange Server 2013 CU23, Exchange Server 2016 CU18–CU19, Exchange Server 2019 CU7–CU8

Affected OS versions

Windows Server 2012 R2Windows Server 2016Windows Server 2019
Fixed inKB5000871 (applies to 24 product versions)
Real-world incidentsWhat we've seen

Microsoft released emergency patches on March 2, 2021, acknowledging active exploitation by Hafnium (a Chinese state-sponsored group). Within two weeks, over 250,000 Exchange servers were compromised globally. Criminal ransomware groups followed within days of public PoC release. The US CISA issued Emergency Directive 21-02 requiring federal agencies to patch within 48 hours.

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB5000871

Manual remediation steps

⏱ 2 hours including service restart and verification

Apply the Microsoft Security Update

Microsoft has released an official security update that fixes this vulnerability.

Required KB Update

    1
    KB5000871 — https://support.microsoft.com/help/5000871

Supersedes: KB4593466, KB4602269

Affected Products

    1
    Microsoft Exchange Server 2013 Cumulative Update 21
    1
    Microsoft Exchange Server 2013 Cumulative Update 22
    1
    Microsoft Exchange Server 2013 Cumulative Update 23
    1
    Microsoft Exchange Server 2016 Cumulative Update 10
    1
    Microsoft Exchange Server 2016 Cumulative Update 11
    1
    Microsoft Exchange Server 2016 Cumulative Update 12
    1
    Microsoft Exchange Server 2016 Cumulative Update 13
    1
    Microsoft Exchange Server 2016 Cumulative Update 14
    1
    Microsoft Exchange Server 2016 Cumulative Update 15
    1
    Microsoft Exchange Server 2016 Cumulative Update 16
    1
    Microsoft Exchange Server 2016 Cumulative Update 17
    1
    Microsoft Exchange Server 2016 Cumulative Update 18
    1
    Microsoft Exchange Server 2016 Cumulative Update 19
    1
    Microsoft Exchange Server 2016 Cumulative Update 8
    1
    Microsoft Exchange Server 2016 Cumulative Update 9
    1
    Microsoft Exchange Server 2019
    1
    Microsoft Exchange Server 2019 Cumulative Update 1
    1
    Microsoft Exchange Server 2019 Cumulative Update 2
    1
    Microsoft Exchange Server 2019 Cumulative Update 3
    1
    Microsoft Exchange Server 2019 Cumulative Update 4
    1
    (…4 more product versions)

Installation Methods

Windows Update (recommended)

1
Settings → Windows Update → Check for updates
2
The security update is offered if your system is in scope
3
Restart when prompted (may or may not be required for this update)

Microsoft Update Catalog (manual download)

1
Open https://catalog.update.microsoft.com
2
Search for KB5000871
3
Download the package matching your OS architecture and Windows build
4
Run the .msu installer with administrator privileges
5
Restart when prompted

WSUS / SCCM / Intune

Approve KB5000871 for the affected products in your update management console.

Microsoft Download Center Links

    1
    http://www.microsoft.com/download/details.aspx?familyid=101995fc-65a6-47af-a580-5467c5e8c94a
    1
    http://www.microsoft.com/download/details.aspx?familyid=1255ecd7-b187-4839-96c9-1fc5e05df7b6
    1
    http://www.microsoft.com/download/details.aspx?familyid=192fa60f-664a-4f3e-b19f-e295135e469b
    1
    http://www.microsoft.com/download/details.aspx?familyid=1a07c860-4149-4a9e-b9cc-6a656a7e8916
    1
    http://www.microsoft.com/download/details.aspx?familyid=221f9562-f2af-4dda-a8a3-e5a81ddc5f2b
    1
    (…19 more)

Verification

Confirm the update is installed:

Get-HotFix | Where-Object { $_.HotFixID -in @('KB5000871') }

References

    1
    Microsoft Security Response Center: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
    1
    KB article: https://support.microsoft.com/help/5000871
    1
    NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2021-26855
    1
    CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26855

Discovery Credit

Microsoft Threat Intelligence Center (MSTIC), Orange Tsai from DEVCORE research team, Volexity

PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2021-26855↗ MSRC Advisory↗ KBKB5000871
CVEs in this update4 fixes · Patch-to-CVE mapping
Patch IDCVE IDVulnerability Name / TypeCVSSReference
KB5000871CVE-2021-26855See NVD9.8NVD ↗
KB5000871CVE-2021-26857See NVD9.8NVD ↗
KB5000871CVE-2021-26858See NVD9.8NVD ↗
KB5000871CVE-2021-27065See NVD9.8NVD ↗

Related vulnerabilities

CRITICAL9.8

KB5001779: Windows Server 2016 / 2019 Security Update (August 2021)

Microsoft Exchange Server

CVE-2021-34473

CRITICAL8.8

KB5019758: Microsoft Exchange Server 2013 / 2016 / 2019 Security Update (October 2022)

Microsoft Exchange Server

CVE-2022-41040

MEDIUM6.5

KB5002741: Windows Server Security Update (July 2025)

Microsoft SharePoint

CVE-2025-49706