ProxyLogon is the name given to a set of four Microsoft Exchange Server vulnerabilities that Microsoft patched on 2 March 2021 after exploitation by a state sponsored group it calls HAFNIUM. Other actors followed. The core lesson is about exposure: internet facing servers need an owner and a fast patch path.
What happened and when?
The dates below come from Microsoft and CISA.
- 2 March 2021: Microsoft published its post on HAFNIUM targeting Exchange servers and released security updates for the vulnerabilities. It urged customers to update on-premises systems immediately.
- 3 March 2021: CISA published its first version of advisory AA21-062A.
- 5 March 2021: Microsoft updated its post to say other malicious actors besides HAFNIUM were also exploiting the flaws against unpatched systems.
- 15 and 16 March 2021: Microsoft added a one click mitigation tool and then investigation guidance.
- April 2021: Microsoft's April security update disclosed and mitigated additional significant vulnerabilities in on-premises Exchange 2013, 2016 and 2019, according to CISA.
- 19 July 2021: CISA added attribution of the activity to actors affiliated with the PRC Ministry of State Security.
Which flaws were involved?
Four CVEs. CVE-2021-26855 is a server side request forgery that let an unauthenticated attacker send arbitrary HTTP requests and authenticate as the Exchange server. CVE-2021-26857 is an insecure deserialization flaw in the Unified Messaging service that allowed code execution as SYSTEM. CVE-2021-26858 and CVE-2021-27065 are post authentication arbitrary file writes.
Attackers could chain the first with the others, or use stolen administrator credentials for the post authentication flaws.
What did attackers do after getting in?
Microsoft describes web shells deployed for access, followed by credential theft from memory, data compression, mailbox export through Exchange PowerShell snap-ins and reverse shells. CISA reported that it identified ten web shell variants tied to the activity and that DearCry ransomware was observed on compromised on-premises Exchange servers. Exchange Online was not known to be affected.
What should defenders learn?
Patching is not the end of the incident. CISA told organizations to check for compromise going back to at least 1 January 2021, because exploitation began before the patch existed. If you find activity, CISA says to assume network identity compromise and follow incident response procedures.
Know what you expose. Exchange servers reachable from the internet were the target. CISA's interim advice, if patching was not immediately possible, was to restrict untrusted connections to port 443 or place a VPN in front, block external access to certain paths, or disconnect the servers. Those were temporary measures only.
Version prerequisites slow you down. The March patches required specific cumulative updates, and servers on older ones had to upgrade first. A team that had let servers fall behind could not patch quickly.
Keep forensic evidence. CISA advised collecting memory, registry hives and logs with minimally invasive tools before changing the system.
Software inventory is the first step. You can only patch what you know you run. For your own products, an inventory of components, including third party servers and libraries, answers the first question in an incident: are we affected? Safeguard builds that inventory for the code you ship, though it does not replace patch management for on-premises servers.
What to do
- List every internet facing server and name an owner for each.
- Subscribe to vendor and CISA advisories for the products you run.
- Measure how long your last emergency patch took end to end.
- Keep systems within one update of current so that an emergency patch is a single step.
- Write a checklist for hunting after patching: logs, web shells, new accounts, scheduled tasks.
- Pre-agree who may disconnect a system from the internet and on whose authority.
- Preserve evidence before you clean.
Quick check
Was Exchange Online affected by ProxyLogon?
CISA's advisory says Exchange Online and Microsoft 365 were not known to be affected. The issue was in on-premises Exchange Server.
If we patched in March 2021, are we safe?
Patching closes the hole but does not remove an attacker who was already in. Microsoft and CISA published ways to check for compromise.
Sources
Last reviewed: 18 October 2026.
