Incident-response reporting places in-the-wild exploitation of on-premises Microsoft Exchange as early as January 3, 2021. That date is the timeline anchor for ProxyLogon, and it sits almost two months before Microsoft's emergency patches on March 2, 2021. The gap between quiet exploitation and public fix is the entire story: by the time defenders could patch, many servers had already been compromised, and the patch alone could not undo that.
ProxyLogon is a chain, not a single CVE. Four vulnerabilities are involved, and observed attacks combined them in different ways. Treating it as one bug—or insisting all four were used in every intrusion—misrepresents how the attacks actually worked.
The chain's components each play a distinct role:
CVE-2021-26855 is a pre-authentication server-side request forgery (SSRF) in the Exchange frontend, or Client Access Service, enabling arbitrary requests to backend services and an authentication bypass. CVE-2021-26857 is an insecure deserialization flaw in the Unified Messaging service, permitting code execution as SYSTEM under the relevant conditions. CVE-2021-26858 and CVE-2021-27065 are post-authentication arbitrary file-write flaws; the latter is chainable with CVE-2021-26855 to place a web shell.
Affected on-premises versions included Exchange Server 2013 Cumulative Updates 21–23, Exchange Server 2016 Cumulative Updates 8–19, and Exchange Server 2019 from RTM through Cumulative Update 8. Importantly, the evidence does not identify Exchange Online as vulnerable in this incident—this was an on-premises problem. The supplied research does not provide reliable CVSS base scores for all four CVEs, so this article describes the chain as critical and capable of unauthenticated remote compromise rather than presenting a score table that would require direct verification against each Microsoft or NVD record.
Exchange accepted internet-facing HTTP requests through a frontend that routed traffic to internal backend services. CVE-2021-26855 let an unauthenticated attacker influence that routing—including through manipulation of the X-BEResource cookie—so an external request could be treated as an internal backend request.
That SSRF did not by itself explain every observed web shell. Its power came from the trust transition it created: the attacker could reach privileged Exchange endpoints and impersonate an administrator in the backend request flow. The post-authentication file-write flaws then allowed malicious files to be written to server paths, including web-accessible locations. A web shell provided a persistent command interface long after the original exploit request had ended.
CVE-2021-26857 offered a distinct code-execution path through unsafe deserialization in Unified Messaging. The right way to describe this is as a flexible chain: observed attacks used different combinations, with CVE-2021-26855 plus a file-write flaw forming the best-known ProxyLogon route. Presenting one rigid four-step recipe would overstate how uniform the attacks were.
Microsoft attributed the initial campaign to HAFNIUM, described as a state-sponsored group operating from China. The U.S. government subsequently attributed malicious Exchange activity to actors affiliated with the People's Republic of China Ministry of State Security. That HAFNIUM attribution should stay tied to the initial activity.
After disclosure, many other actors piled onto exposed servers. CISA documented web-shell deployment, credential theft, mailbox access, data exfiltration and secondary threats including DearCry ransomware. The initial attribution therefore should not be generalized to every compromise found after March 2. It is also worth keeping DEVCORE's independent discovery separate from Volexity's evidence of prior exploitation—DEVCORE reported the bugs to Microsoft on January 5, 2021, two days after Volexity-linked evidence places exploitation.
One government-oriented estimate cited approximately 30,000 affected organizations, including small businesses and state, local, tribal and territorial governments. Separate incident reporting described tens of thousands of compromised organizations worldwide. These figures are broadly compatible in order of magnitude, but they arise from different reporting contexts and should remain attributed estimates rather than a precise, reconciled global total.
The impact included persistent access to internet-facing email servers, exposure of mailboxes and credentials, arbitrary code execution and installation of web shells. And here is the crucial nuance: because patching did not remove an already-implanted web shell, the number of patched servers was never equivalent to the number of remediated incidents.
Preserving Exchange logs and memory images for forensic triage takes dependable capacity. The Samsung T7 Portable SSD is fast, portable storage for incident-response evidence collection and offline analysis.
Amazon Affiliate Link
Microsoft released emergency updates on March 2, 2021. CISA issued Emergency Directive 21-02 the next day, on March 3, requiring federal agencies to identify on-premises Exchange servers, preserve and inspect logs and memory, apply patches where no compromise was found, and disconnect systems when compromise was detected or reliable triage was unavailable.
Microsoft and CISA released tooling, including Test-ProxyLogon.ps1, the Microsoft Safety Scanner and the Exchange On-premises Mitigation Tool. Later CISA directions required additional updates, least-privilege measures, restrictive firewall configuration and centralized log retention. The defensive sequence mattered: investigate, patch, remove persistence, rotate affected credentials and harden. Installing the update alone could prevent a new exploit, but it could never prove a previously exposed server was clean.
ProxyLogon demonstrated the systemic risk of internet-facing collaboration infrastructure that is simultaneously an identity-rich application, a sensitive data store and a privileged Windows server. A request-routing flaw became a path to durable server-side persistence.
The incident also made "patch versus incident response" a practical distinction for mainstream administrators, not just specialists. Once active exploitation preceded the update, every vulnerable server had to be treated as both a patch-management problem and a potential forensic case. That is the enduring lesson: for ProxyLogon, the emergency patch was the beginning of remediation, not the end.