ProxyLogon CVE-2021-26855 SSRF via X-AnonResource-Backend or X-BEResource Cookie

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•5

Detects incoming HTTP requests to Microsoft Exchange servers containing malicious X-AnonResource-Backend or X-BEResource headers, which are indicative of an attempt to exploit the ProxyLogon SSRF vulnerability (CVE-2021-26855).