CVE-2021-26855 Exchange ProxyLogon SSRF via Malformed X-BEResource Cookie

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•7

Detects Server-Side Request Forgery (SSRF) attempts targeting Microsoft Exchange via the /autodiscover/ endpoint. The attack leverages a specifically crafted X-BEResource header containing an internal IP address, which is indicative of the CVE-2021-26855 vulnerability used in ProxyLogon exploitation.