Four zero-day vulnerabilities in Microsoft Exchange servers have been used in chained attacks in the wild.

CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065: Four Zero-Day Vulnerabilities in Microsoft Exchange Server Exploited in the Wild

Microsoft Exchange Server Remote Code Execution Vulnerability

This plugin detects the potential presence of a web shell in selected directories and this can be indicative that the host might have been targeted in the Hafnium campaign. It is recommended that the results are manually verified and appropriate remediation actions taken.

Note that Nessus has not tested for this issue but has instead looked for .aspx files that could potentially indicate compromise.

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by a vulnerability:

  - A remote code execution vulnerability. An attacker could exploit this to   execute unauthorized arbitrary code. (CVE-2021-26857)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker could exploit this to   execute unauthorized arbitrary code. (CVE-2021-26412, CVE-2021-26854,   CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065,   CVE-2021-27078)

ID	Name	Product	Family	Type	Severity
147193	Potential exposure to Hafnium Microsoft Exchange targeting	Nessus	Windows	Local	high
147024	Security Update for Microsoft Exchange Server 2010 SP 3 (March 2021)	Nessus	Windows : Microsoft Bulletins	Local	high
147003	Security Updates for Microsoft Exchange Server (March 2021)	Nessus	Windows : Microsoft Bulletins	Local	critical

Detections

Analytics

CVE-2021-26857

high

Tenable Plugins

high

high

critical