probablysecure/triage-cve-2021-26855-proxylogon---microsoft-exchange-Hands-on CVE triage lab: analyze NVD entries, decode CVSS vectors, map CWE weaknesses, and contextualize risk for high-profile exploits like ProxyLogon.
For this lab, the goal was to practice triaging a well-known real-world vulnerability the way a security team might: reading the CVE details, understanding the CVSS score, and reasoning through how risky it actually is depending on the situation.
I went to the National Vulnerability Database and looked up the CVE:
https://nvd.nist.gov/vuln/search#/nvd/home?resultType=records
I searched for CVE-2021-26855 and opened the result page.
After reading through the description, I answered a few basic questions to understand what's actually at risk:
I found the CVSS score and vector string listed on the page:
I went through the vector string piece by piece to see what each part actually meant:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Basically, this means an attacker doesn't need any credentials or user interaction to exploit it, and if they do, they can fully compromise confidentiality, integrity, and availability. That combination is a big part of why this CVE was treated as such a serious, actively-exploited vulnerability at the time.
I checked the Weakness Enumeration section on the NVD page to see what category of weakness this actually is.
The CWE listed is CWE-918: Server-Side Request Forgery (SSRF). In plain terms, this means the server takes a URL or request from somewhere else and fetches it, without properly checking that the request is actually going where it's supposed to.
I considered whether I'd treat this as higher or lower risk under two different scenarios.
Scenario 1: The vulnerable software is live and reachable. Higher risk. This vulnerability lets an attacker access mailboxes and files that aren't theirs, and run code or make changes on the system.
Scenario 2: The vulnerable software is installed on a machine that's powered off and not reachable. Lower risk. With no power or network connection, there's no way for an attacker to actually reach the server to exploit the vulnerability in the first place.
This exercise was a good reminder that a CVE's severity score isn't the whole picture, the actual risk also depends on context, like whether the vulnerable system is even reachable. A critical vulnerability on an offline machine is a very different risk than the same vulnerability on a live, internet-facing server.