Exchange ProxyShell timeline, from quiet patches to mass exploitation

ProxyShell is the name for three Microsoft Exchange vulnerabilities chained into unauthenticated remote code execution. Microsoft patched them in April and May 2021, researchers explained the chain in early August, and attacks followed within days. The main lesson is about the gap between a quiet patch and public detail.

What was the chain?

The three CVEs are CVE-2021-34473 (remote code execution), CVE-2021-34523 (elevation of privilege) and CVE-2021-31207 (security feature bypass). Tenable notes that Microsoft rated the last two "Exploitation Less Likely" when each was assessed alone, yet chained with the first they let an attacker run commands on a vulnerable server over port 443 without authentication.

Mandiant lists affected on premises versions as Exchange 2013 (CU23 and below), 2016 (CU20 and below) and 2019 (CU9 and below), and says Exchange Online is not affected.

What is the timeline?

• 13 April 2021. Microsoft releases the patch for CVE-2021-34473 and CVE-2021-34523.
• 11 May 2021. Microsoft releases the patch for CVE-2021-31207.
• July 2021. Microsoft publishes advisories for the first two CVEs. Tenable reports Microsoft later said they had been inadvertently omitted from its security update guide.
• Early August 2021. DEVCORE researcher Orange Tsai presents the chain at Black Hat USA and DEF CON.
• 6 August 2021. A researcher reports exploitation attempts against an Exchange honeypot, according to Tenable.
• 17 August 2021. Public research is published, per Mandiant, which responded to exploitation at a US university soon after.
• 21 August 2021. CISA issues an urgent alert saying actors are actively exploiting all three and urging organizations to apply Microsoft's May 2021 update.
• 2 September 2021. Mandiant reports it is tracking eight groups exploiting ProxyShell.
• October 2021. CISA's advisory AA21-321A reports an actor using CVE-2021-34473 for initial access.

Dates come from the vendors and agencies cited below. Details can differ slightly between sources, so check the originals before quoting.

What did attackers do after getting in?

Mandiant describes mostly automated activity, with internal reconnaissance, credential theft, lateral movement and tunneling tools. In one pattern, attackers created draft emails with encoded web shells, and exporting the mailbox to a PST file wrote a working web shell file into a web accessible path. Tenable reports that attackers used the chain to deploy LockFile ransomware, per Symantec and Huntress.

What should defenders learn?

The patch was the fix, and it existed. Everything exploited in August had a fix months earlier. The risk sat in servers that were not updated, and in the fact that two of the bugs had advisories published late.

Exposure matters as much as version. Mandiant advised blocking inbound TCP 80 and 443 to on premises Exchange from the internet if patching was not possible right away. Know which servers face the internet.

Patching is not the end. Mandiant also recommends checking logs on any vulnerable server even if no web shell is found, since attackers may use only part of the chain. Patched late means possibly compromised earlier.

Hunt for the effects. Look for unexpected child processes of the web worker process, odd files in web paths, and mailbox export requests from system accounts.

What to do

1. Inventory all on premises Exchange servers and their build numbers.
2. Confirm the April and May 2021 updates, or later ones, are installed.
3. Check which servers are reachable from the internet and restrict them.
4. Review IIS, Exchange and PowerShell logs on servers that were unpatched in August 2021.
5. Enable file integrity monitoring on web servers.
6. Subscribe to vendor advisories and track CVEs for each product you run.
7. Set a target for patching internet facing systems and measure it.

Quick check

Sources

• CISA: urgent alert on ProxyShell, 21 August 2021
• Tenable: ProxyShell, attackers actively scanning
• Mandiant: ProxyShell exploitation of Microsoft Exchange servers
• CISA advisory AA21-321A

Last reviewed: 18 October 2026.