← Back to all briefings
Cybersecurity 6 min read Published Updated Credibility 89/100

Microsoft Issues Out-of-Band Patches for Exchange Server ProxyLogon Zero-Days

ProxyLogon was a five-alarm fire. Four zero-days in Exchange Server let attackers drop web shells and steal mailboxes without authentication. Chinese state hackers (HAFNIUM) hit first, then criminal groups piled on. Tens of thousands of servers compromised before patches existed. If you were running on-prem Exchange in March 2021, you were either patching, hunting for web shells, or both.

Kodi C.

Editor & Research Lead

Accuracy-reviewed by the editorial team

Cybersecurity pillar illustration for Zeph Tech briefings
Cybersecurity threat, control, and response briefings

On 2 March 2021 Microsoft released emergency security updates for Microsoft Exchange Server 2013, 2016, and 2019 to address a cluster of zero-day vulnerabilities that became known collectively as ProxyLogon. The core server-side request forgery bug (CVE-2021-26855) could be chained with post-authentication vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) to gain remote code execution, deposit web shells, and steal mailboxes.

Microsoft attributed the earliest activity to a Chinese state-linked group it tracks as HAFNIUM but documented at least a half-dozen criminal groups weaponizing the exploit kit within days of disclosure. Tens of thousands of on-premises Exchange instances worldwide were compromised before patches were available, placing regulated industries, governments, and small enterprises into immediate crisis response.

The coordinated disclosure triggered urgent directives from authorities. The Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 21-02 on 3 March, requiring U.S. federal agencies to either patch or disconnect vulnerable Exchange servers and to run Microsoft’s provided mitigation scripts. Germany’s BSI, France’s ANSSI, Singapore’s CSA, and the UK’s NCSC all published advisories emphasizing the high likelihood of compromise. For boards and regulators, ProxyLogon crystallized the risks of maintaining legacy on-premises email infrastructure without strong patch governance, logging, and incident response playbooks.

Attack sequence and forensic expectations

ProxyLogon begins with CVE-2021-26855, which allowed an unauthenticated attacker to send crafted requests to the Exchange Control Panel (ECP) endpoint, impersonating an administrator. Successful exploitation granted access to the PowerShell backend, where attackers executed commands to dump credentials, create new mailbox exports, and install web shells such as China Chopper. Once a shell existed, adversaries uploaded additional tooling—ProcDump, 7-Zip, or custom exfiltration scripts—and moved laterally using compromised service accounts.

Microsoft published detailed indicators of compromise, but organizations were expected to go further. CISA required agencies to collect and preserve IIS logs, Windows Event Logs, and memory captures.

The FBI later obtained a court order allowing it to remove web shells from private-sector servers, highlighting the scope of intrusion. Governance teams needed to require security operations center (SOC) analysts review at least 30 days of historical logs, compare against known malicious hashes, and check Active Directory for unauthorized account creation. Organizations with incomplete logging were advised to assume breach and execute full password resets, certificate reissuance, and endpoint scans.

Immediate remediation workflow

Microsoft’s patches addressed the vulnerabilities, but they did not evict existing adversaries. The company released Exchange On-premises Mitigation Tool (EOMT) and PowerShell scripts (Test-ProxyLogon.ps1, EOMT.ps1) to help administrators apply URL rewrite mitigations, scan for web shells, and install updates. Security teams needed to verify patch levels against cumulative updates (CU) and security updates (SU) per build number, because unsupported Exchange versions required interim mitigations or accelerated migrations to supported releases.

Incident commanders were expected to follow a structured plan:

  1. Stabilize services. Back up Exchange servers, isolate them from the internet if needed, and ensure redundant communication channels for teams.
  2. Apply updates. Install the March 2021 security updates or the later April cumulative fixes, documenting times and responsible personnel for audit purposes.
  3. Hunt and eradicate. Run forensic scripts, check \inetpub\wwwrootspnet_client and \Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owauth for malicious ASPX files, and delete unauthorized scheduled tasks or services.
  4. Recover and harden. Rotate credentials, revoke OAuth tokens, rebuild compromised servers if persistence cannot be ruled out, and enable multi-factor authentication across privileged accounts.

Throughout, organizations needed to maintain evidence chains for potential regulatory reporting. Exchange servers that processed personal data triggered GDPR, HIPAA, or sector-specific breach notification obligations when exfiltration could not be excluded.

Governance and board reporting

ProxyLogon exposed weaknesses in asset inventory and patch cadence. Boards demanded clear answers on how many Exchange servers remained on-premises, whether they were supported builds, and why compensating controls failed. Risk committees expected management to show alignment with NIST SP 800-53 RA-5 continuous monitoring controls and to show that vulnerability disclosure channels—MSRC advisories, CISA alerts, ISAC bulletins—feed into automated triage workflows.

Organizations with Sarbanes-Oxley internal control obligations documented the incident within their disclosure controls. The SEC then inquired how issuers assessed materiality of Exchange compromises, pressing companies to quantify exposure, business interruption, and remediation spend. Insurers likewise scrutinized incident response, invoking policy clauses around timely patching and basic security hygiene. Many enterprises launched accelerated programs to migrate mail to Exchange Online or alternative cloud providers, combining the move with data-loss prevention and zero-trust email security improvements.

Supply chain and third-party implications

Managed service providers (MSPs) and hosted Exchange partners represented a significant blind spot. Numerous small businesses relied on vendors for patching, yet service-level agreements often lacked explicit timelines for out-of-band updates.

ProxyLogon therefore prompted procurement teams to revise contracts, adding clauses that require providers to apply critical patches within 24 hours, maintain immutable logging, and furnish evidence of compromise assessments upon request. Financial regulators, including the UK Prudential Regulation Authority and the Monetary Authority of Singapore, reminded firms that outsourcing does not transfer accountability: regulated entities must independently verify that vendors patched and investigated.

For software supply-chain governance, ProxyLogon energized Secure Software Development Framework (SSDF) adoption. Enterprises began cataloguing self-hosted software that exposes administrative interfaces to the internet and instituted change freezes until emergency patch pipelines were validated. Some organizations mandated tabletop exercises that simulate the discovery of zero-day exploitation, ensuring executive familiarity with crisis communication, legal notification requirements, and cross-border coordination when mailboxes contain data for EU or APAC jurisdictions.

Long-term hardening measures

Post-incident reviews consistently recommended reducing the attack surface by retiring unsupported Exchange builds, segmenting management networks, and enabling Extended Protection for Authentication. Microsoft released additional tools—such as the Exchange Emergency Mitigation service in cumulative updates and integration with Microsoft Defender for Endpoint—to automate response to future exploits. Security teams also deployed application allow-listing, focus ond deployment of Endpoint Detection and Response (EDR) agents on Exchange servers, and enabled HTTP response header hardening to block common web shell callbacks.

More broadly, organizations used ProxyLogon as a catalyst to modernize vulnerability governance. Leading practices included maintaining an authoritative configuration management database (CMDB), ranking critical systems by business service impact, and linking vulnerability SLAs to risk appetite statements. Boards requested quarterly updates on the closure of post-mortem action items, such as implementing centralized log retention with at least 12 months of searchable history and adopting threat intelligence subscriptions that provide early warning of exploit spread.

Regulatory follow-up

ProxyLogon’s fallout continued through 2021. The U.S. Department of Justice announced indictments against individuals tied to HAFNIUM’s infrastructure, while the EU issued joint statements condemning state-sponsored exploitation. CISA kept the vulnerabilities on its Known Exploited Vulnerabilities (KEV) catalog, effectively mandating ongoing patch compliance for federal contractors. The House Oversight Committee held hearings probing why agencies maintained unsupported servers, leading to renewed investment in modernization funds.

For compliance officers, the incident underscored the need to blend rapid technical response with disciplined governance. Maintaining pre-approved emergency change procedures, retaining third-party forensics, and aligning communication with legal counsel remain decisive factors in meeting regulatory expectations and protecting customer trust when zero-day exploitation becomes public.

Similar analysis

Additional analysis covering similar themes.

Continue in the Cybersecurity pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

  • Cybersecurity Operations Playbook

    Use our research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.

  • Network Security Fundamentals Explained Practically

    A practitioner-focused guide to network security fundamentals covering firewalls, segmentation, IDS/IPS, DNS security, VPNs, wireless security, zero trust architecture, and traffic…

  • Small Business Cybersecurity Survival Checklist

    A budget-conscious cybersecurity checklist built specifically for small businesses. This guide covers foundational security policies, network hardening, employee training, phishing…

Coverage intelligence

Published
Coverage pillar
Cybersecurity
Source credibility
89/100 — high confidence
Topics
Microsoft Exchange · ProxyLogon · Zero-day vulnerabilities · Incident response
Sources cited
3 sources (microsoft.com, cisa.gov, iso.org)
Reading time
6 min

Further reading

  1. Microsoft Security Blog — HAFNIUM targeting Exchange Servers — microsoft.com
  2. CISA Alert AA21-062A — Mitigating Microsoft Exchange Server Vulnerabilities — cisa.gov
  3. ISO/IEC 27001:2022 — Information Security Management Systems — International Organization for Standardization
  • Microsoft Exchange
  • ProxyLogon
  • Zero-day vulnerabilities
  • Incident response
Back to curated briefings

Comments

Community

We publish only high-quality, respectful contributions. Every submission is reviewed for clarity, sourcing, and safety before it appears here.

    Share your perspective

    Submissions showing "Awaiting moderation" are in review. Spam, low-effort posts, or unverifiable claims will be rejected. We verify submissions with the email you provide, and we never publish or sell that address.

    Verification

    Complete the CAPTCHA to submit.