ProxyLogon (CVE-2021-26855).

ProxyLogon (CVE-2021-26855) is a pre-authentication SSRF in Microsoft Exchange Server that lets an attacker send arbitrary HTTP requests as the Exchange server. Chained with CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065, attackers achieved unauthenticated remote code execution on on-premises Exchange and planted web shells on tens of thousands of mailboxes worldwide in early 2021. Microsoft attributed initial exploitation to the HAFNIUM group; mass exploitation by multiple actors followed within days of the March 2021 emergency patch. Defences: apply the March 2021 security updates (and later cumulative updates), run the Microsoft Safety Scanner and HAFNIUM IOC scripts, and migrate where possible to Exchange Online.