Critical Exchange Server Flaws Mitigated at the Edge

Cloudflare has deployed managed rules to protect its Web Application Firewall (WAF) customers from a set of actively exploited vulnerabilities in Microsoft Exchange Server. These vulnerabilities—CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065—have been leveraged by attackers to compromise on-premise mail servers, exfiltrate inbox data, and establish a foothold for lateral movement across corporate networks.

Organizations running Exchange Server 2013, 2016, or 2019 that have the Cloudflare Specials ruleset enabled are automatically protected at the edge. The rules were deployed in "Block" mode immediately, an unusual step that reflects the active exploitation campaigns underway. Microsoft has likewise urged administrators to apply patches to on-premise systems without delay.

WAF Configuration and Rule Management

For customers with Cloudflare Specials enabled, no additional action is required. If you need to modify or disable the protections—for example, due to false positives—you can manage them through the dashboard:

  1. Navigate to the Cloudflare Firewall tab and select Managed Rules.
  2. Click the "Advanced" link at the bottom of the Cloudflare Managed Ruleset card and locate rule ID 100179.
  3. Adjust the action or disable the rule as appropriate.
  4. Repeat the process for rule ID 100181.

In addition to these two new rules, existing rule ID 100173—also set to Block by default—provides partial mitigation by preventing the upload of certain scripts.

Attack Chain and Vulnerability Breakdown

Security researchers at Volexity have published a detailed analysis of how the zero-day flaws are being chained together in the wild. The attack sequence proceeds as follows:

  • Attackers first exploit CVE-2021-26855, a server-side request forgery (SSRF) vulnerability, to issue arbitrary HTTP requests and authenticate as the Exchange server itself.
  • Using that SYSTEM-level access, they send crafted SOAP payloads to the Unified Messaging Service, which insecurely deserializes them—triggering remote code execution via CVE-2021-26857.
  • Finally, CVE-2021-26858 and CVE-2021-27065 are abused to upload arbitrary files, such as webshells, enabling persistent access, further exploitation, and lateral movement. Authentication for these file writes can be bypassed by combining them with the SSRF flaw.

Server-Side Patching and Detection

Edge filtering alone is not a substitute for remediation. Microsoft has published urgent guidance for patching on-premise Exchange servers, along with interim mitigations for organizations unable to update immediately. To check whether a system remains exploitable, Microsoft has released an Nmap script (http-vuln-cve2021-26855.nse) on GitHub that can be used for verification.

Additional Recommendations

Given the active threat landscape, administrators should also consider restricting access to Exchange endpoints. The CVE guidance recommends deploying a VPN or similar controls to limit exposure of public-facing interfaces. Adopting a Zero Trust architecture—for instance, using Cloudflare for Teams—can further ensure that only trusted connections reach the mail server. While the WAF rules mitigate exploit attempts at the edge, comprehensive protection requires layering these measures with prompt patching and network-level access controls.