Loading story…
DEVCORE disclosed ProxyRelay, an attack surface in Microsoft Exchange Server that can coerce one Exchange server to authenticate over NTLM and relay its machine-account credentials to another Exchange service. Because Exchange machine accounts commonly possess the ms-Exch-EPI-Token-Serialization extended right, a successful relay can enable Exchange-user impersonation, mailbox access, authentication bypass, and, in certain attack chains, remote code execution.
The research covered Exchange Frontend and Backend services, Windows DCOM, and other NTLM-enabled endpoints, including issues tracked as CVE-2021-33768, CVE-2022-21979, CVE-2021-26414, and CVE-2022-24477. Microsoft issued fixes during 2021 and 2022; organizations needed to ensure relevant mitigations were activated, including IIS Extended Protection Authentication for Exchange Backend relay protection and DCOM hardening, which Microsoft enabled by default in June 2022. The disclosure illustrates the kind of high-impact enterprise exploitation research highlighted by the Zero Day Initiative's Pwn2Own Vancouver contest.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft published the CVEs and documentation explaining how to activate the applicable Exchange relay protections.
Microsoft addressed CVE-2022-21979 by forcibly enabling IIS Extended Protection Authentication, eliminating relay attacks against the Exchange Backend. Backend relay could otherwise target EWS, Outlook Anywhere RPC, or Exchange PowerShell services.
Microsoft enabled DCOM hardening by default during the second rollout phase, protecting Exchange servers with current Windows updates from the CVE-2021-26414 relay chain.
Microsoft released Exchange Server 2019 CU12 and Exchange Server 2016 CU23 with relevant architectural code changes. DEVCORE found its exploit still worked because the new protections were not enabled by default.
Microsoft released a fix for CVE-2021-33768 by preventing machine-account logons in the Exchange Frontend proxy handler. Successful relays to the Frontend EWS endpoint could otherwise enable user impersonation and mailbox operations.
DEVCORE reported an Exchange Server NTLM-relay attack surface to the Microsoft Security Response Center. The technique coerces an Exchange server to authenticate to an attacker-controlled host, enabling relay of its machine-account authentication to another Exchange server.
Microsoft patched the Windows DCOM relay issue tracked as CVE-2021-26414. The server-side DCOM hardening initially required administrators to manually activate it using the RequireIntegrityActivationAuthenticationLevel registry value.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited the **ProxyNotShell** chain on on-premises Microsoft Exchange Server by combining `CVE-2022-41040`, an authenticated SSRF flaw, with `CVE-2022-41082`, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server **2013, 2016, and 2019** were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused `WSMAN` and XML SOAP traffic to establish remote shell access. Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including `193.149.185.52:443` and `sync.service.auzreservices.com`, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Jun 29, 2026
Researchers detailed **ProxyShell**, a chain of Microsoft Exchange vulnerabilities that can be combined to bypass authentication, escalate privileges, and achieve remote code execution on exposed Exchange servers. Orange Tsai described the attack surface and showed how flaws including `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` could be chained to reach backend Exchange services and execute attacker-controlled code without valid credentials. Mandiant later reported real-world exploitation of ProxyShell against internet-facing Exchange environments, showing that attackers used the chain to gain shells on compromised servers and establish persistent access. The reporting underscores that unpatched on-premises Exchange systems remained a high-value target because successful exploitation could hand attackers direct control of email infrastructure, enable follow-on intrusion activity, and expose sensitive enterprise communications.
Jul 12, 2026
Microsoft Exchange Server was found to contain **CVE-2021-34473**, a critical flaw in the Autodiscover service that allows **server-side request forgery (SSRF)** and authentication bypass against Exchange Server 2013, 2016, and 2019 on x64 systems. According to Zero Day Initiative, the bug stems from improper URI validation before the service accesses resources, enabling remote, unauthenticated exploitation. Microsoft issued security updates for the vulnerability, while the CVE record assigns it a **CVSS v3.1 score of 9.1** and ZDI rated the issue **10.0**. Although the flaw can be described as an SSRF and auth bypass on its own, advisories note it can be chained with additional Exchange vulnerabilities to achieve **arbitrary code execution as `SYSTEM`**, placing it in the exploitation context widely associated with **ProxyShell**. The issue was reported to Microsoft by **orangetw**, later disclosed through coordinated advisories from Microsoft and ZDI, and remains a high-priority patching concern because it can be exploited remotely without authentication on exposed Exchange deployments.
Aug 15, 2026