CVE-2021-26855 — exploited in the wild

Exploitation observed by OffSeq honeypot sensors · last 30 days · last seen 3 hours ago · first observed 2026-09-23 (29 days ago)

Listed in CISA's Known Exploited Vulnerabilities catalog and still under active attack against OffSeq honeypot decoys.

About CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability

CWE-918

OffSeq's global honeypot fleet recorded 1,745 exploitation attempts against CVE-2021-26855 from 78 distinct source IPs in the last 30 days — direct in-the-wild telemetry: every hit is a real attacker probing a decoy, not a scan of a vulnerability database. It is also present on 2 internet-exposed hosts OffSeq tracked in the last 30 days.

References