Is CVE-2021-27065 (Microsoft Exchange Server Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2021-27065 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

What “exploited in the wild” means for this CVE

For a vulnerability like CVE-2021-27065, the practical question is not just whether a proof of concept exists, but whether defenders should assume real attacker use. Once CISA places an issue in the KEV catalogue, the operating assumption changes: exposure is no longer theoretical, and patch or mitigation work should be treated as urgent rather than routine.

That distinction matters because remote code execution in an internet-facing platform can become a fast initial-access path. If the vulnerable service is reachable, attackers do not need a long chain of preconditions to turn a flaw into foothold, persistence, or follow-on abuse.

How to confirm exposure and scope the fix

The first step is to confirm whether any Exchange Server instance in your environment is actually running the product named in the advisory and whether it is exposed in a way that could be reached by an attacker. Do not rely on asset labels alone; verify the live service, the deployment boundary, and any internet-facing reverse proxy or mail edge path that could still expose the vulnerable component.

For vulnerable Microsoft Exchange Server deployments, remediation should follow the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog rather than ad hoc scheduling. If patching must wait, document the compensating control, the owner, and the expiry date for the exception so the risk does not drift into permanent acceptance.

What to look for after exploitation is suspected

When a KEV-listed RCE has been present, assume attackers may have already used it to gain code execution, place web shells, create new administrative paths, or stage additional access. That is why post-exposure review should not stop at patch verification; it should also include log review, unusual process execution, suspicious file creation, and any sign of mailbox, authentication, or service abuse.

If the server handled credentials, tokens, or administrative sessions during the exposure window, treat those as potentially compromised and rotate them where they could have been accessible to an intruder. The goal is to remove attacker reuse paths, not just close the vulnerability.

Risk and Threat Considerations

Active exploitation changes the risk profile from “known weakness” to “probable attacker interest,” especially when the target is a widely deployed internet-facing service. For Exchange, the main concern is that a remote code execution path can be turned into rapid initial access, followed by persistence and broader compromise.

Failure mechanism: An attacker reaches the exposed service, executes code through the vulnerability, and then uses that foothold to drop tooling, harvest credentials, or expand access before defenders notice.

Impact: The result can include mailbox compromise, lateral movement, service disruption, and ransomware follow-on activity if the environment is not quickly contained and investigated.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The question is about a known exploited vulnerability and urgent remediation.
Recommendation — Prioritise KEV-listed flaws for rapid remediation and validate exposure continuously.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Confirming exposure to a KEV-listed Exchange flaw depends on identifying vulnerable assets.
	PR.PS-02 — Software, Data, and Command Execution is Authorized	Remote code execution exploits abuse unauthorized code execution paths.
	DE.CM-08 — Vulnerability Exploits Are Detected	Active exploitation should be observable through detection and alerting.
Recommendation — Map affected systems and track exposed Exchange instances until the risk is removed. Restrict and monitor code-execution paths that can be abused for remote execution. Tune detection to flag signs of exploitation on internet-facing Exchange servers.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The page recommends verifying exposure and promptly addressing a known exploited flaw.
	SI-2 — Flaw Remediation	Urgent remediation is the core action for an exploited RCE vulnerability.
Recommendation — Continuously monitor for the vulnerable Exchange condition and remediate exposed assets. Apply the vendor fix or approved mitigation as soon as exposure is confirmed.

Practitioner Guidance

What to prioritise: Treat any KEV-listed Exchange RCE as a time-sensitive exposure issue, not a normal vulnerability queue item. Prioritise externally reachable systems first, then systems that broker mail or authentication for other assets.

What to verify: Confirm the vulnerable product is present, verify the fix is actually applied, and check whether the system shows signs of pre-patch compromise. A clean patch does not prove the host was clean before remediation.

Decision rule: If the server was reachable from untrusted networks before remediation, assume compromise is plausible until logs and host artefacts support the opposite. In that case, containment and investigation should happen alongside patching, not after it.

Practitioner takeaway: For exploited-in-the-wild vulnerabilities, the security decision is driven by attacker reality, not by patch status alone, so remediation and compromise assessment should move together.