ProxyLogon
CVE-2021-26855 + 3 chained bugs — pre-auth RCE in Microsoft Exchange Server. Hafnium (Chinese APT) exploited at scale before disclosure.
Disclosed 2 March 2021. Estimated 250,000 Exchange servers compromised globally — FBI got a court order to remotely remove web shells without owner consent (April 2021). Microsoft pushed emergency patches outside cycle. Follow-up family: ProxyShell (August), ProxyToken, ProxyOracle. One of the worst Exchange years ever.