No source can show you its own past. This one can.
Print this page to keep the view as it stands on this date. Everything hidden behind a disclosure opens, and every receipt prints with its value.
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-268574 of 4 sources documented this
rank 71 = 40 + 17 + 3 + 5 + 6
rank@v1 · act now
Someone is already using it
CISA KEV catalog · public proof-of-concept · FIRST EPSS
EPSS 0.95762 · CISA KEV listed · without this subject the record ranks 31
What it costs you if it fires
NVD CVSS base score, then the CNA's own
CVSS 6.8, from NVD · without this subject the record ranks 54
It is getting worse, not staying still
FIRST EPSS series, rescorings and bad loads removed
rose on 2025-09-16 · without this subject the record ranks 68
How much of the world it touches
NVD CPE configurations
4 products in the CPE ranges · without this subject the record ranks 66
Someone else already set the date
CISA KEV remediation due date
CISA remediation date held · without this subject the record ranks 65
Unaudited dollar value2 of 3 inputs carry a receipt
Exposure$4.78Mover the next 30 days, if this record is yours
Movement-$2.86Mon 2025-11-21, the last material move, 9 months before this reading
Basisassumeda published average, not your estate
$4.78M = $4.99M incident cost x 1 exposure x 0.95762 likelihood
udv@v1 · unaudited · wrong for you until you say what you run
$4.99M is the cost of a breach that happened, from IBM Cost of a Data Breach Report 2026, global average. It is not the value of any asset of yours. That average already covers breaches of every severity, so scaling it by exposure understates a partial-impact record. That is an assumption, not a measurement. Your own asset value goes in the decision record.
PLATEAUMinimal movement since 2026-06-15, 81 days at 0.96, as of 2026-09-04. arc-rules@v1
Foresight · where to check next
This record is one instance of CWE-502, deserialization of untrusted data. The index holds 3287 prior instances of this class, 75 KEV-listed. The nearest of its KEV-listed records are drawn beside this. taxonomy@v1
Both shown, dated. We don't pick winners. disagreement-rules@v1
Running Microsoft Exchange Server 2010 Service…? Check your version
A deterministic range check against the ranges this record publishes. It tells you where a version sits in the record, not whether your deployment is exploitable. No account needed.
Watch this record
Matches your own product list against every record this index holds, and tells you when one of them moves.
Choose your verdict, then sign in or use an email link. Your first 100 records are free. Evidence is frozen when the record is created.
Private to your organization unless you share it. Put the proof link in your ticket so a reviewer can inspect the basis for your call. See how decision records work.
Harm, if it fires from the vector and the weakness
Written for the ticket you're about to file.
Reachneeds local access · no privileges required · user interaction required · low attack complexityreceipt
ImpactComplete confidentiality, integrity and availability lossreceipt
Patch available sinceNo dated patch-availability record in held sources. The index holds reference URLs without dates and only the current revision of the CVE record, so the day a fix first existed cannot be derived. Only the versions it landed in.
CISA remediation statusoverdue since 2022-05-03receipt
CISA required actionApply updates per vendor instructions.receipt
Published to CISA KEV246 daysderived
Exploit Status & Known PoCs a ladder, not a score
Current rung: Ransomware campaign use known, 2021-11-03.
RUNG 1Nothing observed in held sources
RUNG 2Proof-of-concept published · 1 public repository2021-03-11receipt
RUNG 3Exploited in the wild · CISA KEV listed2021-11-03receipt
RUNG 4Ransomware campaign use known2021-11-03receipt
Affected productMicrosoft Exchange Server 2010 Service Pack 3; Microsoft Exchange Server 2013 Cumulative Update 21; Microsoft Exchange Server 2013 Cumulative Update 22…receipt
Published rangesmicrosoft exchange server 2010; microsoft exchange server 2013; microsoft exchange server 2016; microsoft exchange server 2019receipt
A rung lights from a row in the index, never from an assessment. "Held sources" is the true scope of the claim: this index reads the CVE record, NVD, CISA KEV, FIRST's EPSS and public proof-of-concept repositories, and it does not observe attacks.
What it is stated by the CNA
ProxyLogon is the common name for CVE-2021-26857. Microsoft Exchange Server Remote Code Execution Vulnerability cve-aliases@2026-08-27
NVD's analysis a second authority
severity
6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
weakness
CWE-502
affected versions
microsoft exchange server 2010; microsoft exchange server 2013; microsoft exchange server 2016; and 1 more, listed in full below
7 Mar 20230.05769 · crossed 0.10 · scoring model v2023.03.01
8 May 20230.44107 · crossed 0.10
6 Jun 20230.23668
19 Jul 20230.36197
11 Sep 20230.72308 · crossed 0.50
22 Sep 20230.83317
16 Nov 20230.45674 · crossed 0.50
30 Nov 20230.66369 · crossed 0.50
7 Feb 20240.53022
19 Feb 20240.46011 · crossed 0.50
5 Mar 20240.68382 · crossed 0.50
23 Feb 20250.54947
17 Mar 20250.09884 · crossed 0.10 and 0.50 · scoring model v2025.03.14
16 Jul 20250.1116 · crossed 0.10
17 Jul 20250.09045 · crossed 0.10
16 Sep 20250.2996 · crossed 0.10
17 Oct 20250.44286
18 Nov 20250.93206 · crossed 0.50 and 0.90
21 Nov 20250.3581 · crossed 0.50 and 0.90
22 Apr 20260.46389
6 May 20260.28236
12 May 20260.41507
15 Jun 20260.94008 · crossed 0.50 and 0.90 · scoring model v2026.06.15
20 Aug 20260.95762
This score more than doubled inside 72 hours. Both observations are in the full history below.
Show all 150 observations
14 Apr 20210.32208
4 Feb 20220.17574
21 May 20220.29336
18 Sep 20220.31092
7 Mar 20230.05769
16 Mar 20230.05369
29 Mar 20230.05044
26 Apr 20230.07213
8 May 20230.44107
10 May 20230.41400
25 May 20230.42647
6 Jun 20230.23668
22 Jun 20230.22747
4 Jul 20230.27572
19 Jul 20230.36197
15 Aug 20230.42083
29 Aug 20230.28956
11 Sep 20230.72308
22 Sep 20230.83317
25 Sep 20230.86308
7 Oct 20230.81745
21 Oct 20230.81335
3 Nov 20230.79467
16 Nov 20230.45674
30 Nov 20230.66369
12 Dec 20230.64258
27 Dec 20230.68495
9 Jan 20240.65361
23 Jan 20240.58996
6 Feb 20240.66702
7 Feb 20240.53022
19 Feb 20240.46011
5 Mar 20240.68382
4 Apr 20240.76477
18 Apr 20240.71652
3 Jun 20240.70660
18 Jun 20240.68319
5 Jul 20240.61562
5 Aug 20240.60407
27 Sep 20240.67124
14 Oct 20240.60377
17 Dec 20240.62034
20 Dec 20240.61868
23 Feb 20250.54947
9 Mar 20250.55444
17 Mar 20250.09884
19 Mar 20250.04726
20 Mar 20250.07699
21 Mar 20250.072
22 Mar 20250.07699
26 Mar 20250.08923
27 Mar 20250.04948
28 Mar 20250.08923
29 Mar 20250.04948
30 Mar 20250.08923
13 Apr 20250.07461
15 Apr 20250.08923
20 Apr 20250.07461
21 Apr 20250.08923
23 Apr 20250.07461
24 Apr 20250.08547
1 May 20250.08192
3 May 20250.07135
4 May 20250.0745
8 May 20250.07369
10 May 20250.04768
19 May 20250.04447
23 May 20250.04822
24 May 20250.05563
1 Jun 20250.05322
4 Jun 20250.05563
15 Jun 20250.06988
26 Jun 20250.06074
27 Jun 20250.07456
29 Jun 20250.0842
1 Jul 20250.08526
2 Jul 20250.05683
4 Jul 20250.05609
6 Jul 20250.07301
15 Jul 20250.09045
16 Jul 20250.1116
17 Jul 20250.09045
30 Jul 20250.09641
1 Aug 20250.09245
4 Aug 20250.09641
1 Sep 20250.09245
2 Sep 20250.08068
4 Sep 20250.08419
13 Sep 20250.07794
16 Sep 20250.2996
17 Sep 20250.28785
18 Sep 20250.2996
1 Oct 20250.33633
4 Oct 20250.346
6 Oct 20250.37768
17 Oct 20250.44286
19 Oct 20250.37768
21 Oct 20250.44286
22 Oct 20250.42269
27 Oct 20250.40549
28 Oct 20250.42269
29 Oct 20250.3581
1 Nov 20250.34831
4 Nov 20250.42269
9 Nov 20250.3581
18 Nov 20250.93206
21 Nov 20250.3581
24 Nov 20250.34542
1 Dec 20250.34831
4 Dec 20250.34542
5 Dec 20250.3581
8 Dec 20250.34542
18 Dec 20250.3581
27 Dec 20250.34159
28 Dec 20250.36884
31 Dec 20250.3581
1 Jan 20260.34831
4 Jan 20260.3581
8 Jan 20260.34542
1 Feb 20260.34831
4 Feb 20260.34542
11 Feb 20260.35604
26 Feb 20260.38152
27 Feb 20260.424
1 Mar 20260.42048
4 Mar 20260.43688
8 Mar 20260.40474
12 Mar 20260.44755
19 Mar 20260.40474
4 Apr 20260.44755
13 Apr 20260.38261
21 Apr 20260.43104
22 Apr 20260.46389
25 Apr 20260.44465
26 Apr 20260.45291
4 May 20260.40993
6 May 20260.28236
8 May 20260.27202
9 May 20260.33089
10 May 20260.37914
12 May 20260.41507
19 May 20260.42679
20 May 20260.41187
21 May 20260.46712
22 May 20260.44743
26 May 20260.40505
30 May 20260.39406
10 Jun 20260.40505
15 Jun 20260.94008
20 Aug 20260.95762
150 observations held. A highlighted step crossed a promotion threshold. A step marked with a scoring model moved because the instrument was replaced, not because the vulnerability changed. receipt
The full biography
Listed by CISA 246 days after it published, exploit probability more than doubled between 2025-09-13 and 2025-09-16 (0.07794 → 0.2996) and the record had been public for 5 years, 6 months when this index was last written.
No material movement in 15 days as of the last ingest this index recorded.
Published 2021-03-02 receipt · Public PoC 2021-03-11 receipt · CISA KEV 2021-11-03 receipt · Index as of 2026-09-04 derived
The pattern, elsewhere
This record is one instance of CWE-502, deserialization of untrusted data. The index holds 3287 prior instances of this class, 75 KEV-listed. The nearest of its KEV-listed records are drawn beside this. [email protected]
CVE-2025-53770 · Microsoft SharePoint Enterprise Server 2016matches 7 of 9KEV listed · 2025receipt
CVE-2023-43208matches 6 of 8KEV listed · 2023receipt
CVE-2022-31199matches 6 of 8KEV listed · 2022receipt
CVE-2021-35464matches 6 of 8KEV listed · 2021receipt
CVE-2021-42237matches 6 of 8KEV listed · 2021receipt
CVE-2026-45659 · Microsoft SharePoint Enterprise Server 2016matches 6 of 9KEV listed · 2026receipt
"Matches n of m" counts the attributes the two records can both be compared on: the CVSS metrics they share a version of, any weakness class beyond this one, and the vendor. fit-rules@v1
3287 records in this class held. The six above are drawn from the ones CISA has listed as exploited, ranked by how much of the record matches this one. That is why every one of them is KEV-listed: the pool is, so the colour on those spokes says nothing the pool has not already said.
No curated product neighbourhood is held for this product, so the records above are the nearest this index can name. The neighbourhood table covers a small set of products and is extended by hand.