An org would have caught ProxyShell if it knew where every on-premises Exchange server was, patched internet-facing mail servers within days, and watched those servers for unusual behavior. If any of those three is shaky today, the same gap will hurt on the next mail server flaw.
What was ProxyShell?
ProxyShell is the name for a chain of three Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207. In August 2021 CISA warned that attackers were actively exploiting them, and said exploitation could let an attacker run code of their choice on a vulnerable machine. CISA's advice was plain: find your vulnerable systems and install Microsoft's May 2021 security update, which it said fixes all three.
One detail needs care. Some secondary write-ups say two of the three fixes shipped in April 2021 and one in May. CISA's alert points to the May update for all three, so a server that has the May 2021 update or anything newer is the safe baseline. If you are reading build numbers, check Microsoft's own Security Update Guide entry for each CVE.
This is a checklist, not a blame exercise. Mail servers are hard to patch. They are busy, they are tied to business hours, and many teams inherited them. The point is to find which controls would have turned a weeks-long exposure into a short one.
Checklist: the five questions
1. Inventory. Can you list every Exchange server, including the forgotten one in a branch office or a lab that still receives mail? If the answer comes from memory instead of a system, you have an inventory gap. CISA's instruction to "identify vulnerable machines" only works if the list exists before the alert does.
2. Exposure. Which of those servers answer from the internet, and why? Compare what your external scan sees with what your inventory says. Differences in either direction are findings.
3. Patch speed. For a flaw under active exploitation, how many days pass between a vendor fix and your production servers? Measure the last three critical mail patches. If the median is weeks, write down the blocker: change windows, lack of a test copy, a cumulative update prerequisite, or ownership.
4. Detection. Would anyone notice a new file appearing in a web-served folder on a mail server, or a mail server starting a process it never ran before? Endpoint detection on mail servers is sometimes switched off for performance. Ask whether yours is on, and who reads its alerts.
5. Containment. If the server were taken over tonight, what could it reach? A mail server that can talk to domain controllers and file shares freely gives an intruder a short road. Segmentation limits that road.
How does this relate to software supply chain work?
An Exchange server is third-party software you run, so the same questions apply to every product you did not write: do you know it exists, do you know its version, and do you hear about its flaws fast enough? An inventory of installed software and a feed of known exploited vulnerabilities answer the first two. Reachability analysis helps with libraries inside your own code, but for a packaged server like Exchange the deciding factors are exposure and patch speed.
What to do
- Build or refresh an inventory of every mail server and other internet-facing packaged product, with owner and version.
- Run an external exposure check and reconcile it with the inventory.
- Set a target for patching internet-facing products under active exploitation and measure against it monthly.
- Confirm endpoint detection runs on mail servers and that alerts reach a person.
- Review which internal systems each mail server can reach, and cut what it does not need.
- Practice the first hour of a mail server compromise in a tabletop exercise.
Quick check
Which CVEs make up ProxyShell?
CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207, according to CISA's alert.
Is patching enough after a flaw like this?
Patching stops new exploitation, but it does not remove an intruder who got in earlier. For exposed servers that were unpatched during the exploitation window, also review them for signs of compromise.
Sources
Last reviewed: 18 October 2026.
