---
updatedAt: 2025-08-14T17:13:43.000Z
agentTools:
  siteIndex: https://developer.n-able.com/llms.txt
  projectIndex: https://developer.n-able.com/n-central/llms.txt
---

# CVE-2021-26855 IOC

```php PHP
<?xml version="1.0" encoding="utf-8" standalone="yes"?><Policy ID="73fdb95e-9dff-4ec7-961c-c1e8a38e9e7b" Name="CVE-2021-26855 IoC" Description="UGFyc2VzIEV4Y2hhbmdlIGxvZyBmaWxlcyB0byBzZWFyY2ggZm9yIGVtcHR5IEF1dGhlbnRpY2F0ZWRVc2VyIGFuZCBBbmNob3JNYWlsYm94IGNvbnRhaW5zIHRoZSBwYXR0ZXJuIG9mIFNlcnZlckluZm9+Ki8qDQpTZWUgaHR0cHM6Ly93d3cubWljcm9zb2Z0LmNvbS9zZWN1cml0eS9ibG9nLzIwMjEvMDMvMDIvaGFmbml1bS10YXJnZXRpbmctZXhjaGFuZ2Utc2VydmVycy8gZm9yIG1vcmUgaW5mby4=" Version="2.16.0.1" MinRequiredVersion="2.16.0.1" RemoteCategory="0" ExecutionType="Local" MinimumPSVersionRequired="0.0.0">
  <Object ID="{e54b6b8d-ec7b-4cd1-b9ce-5cdc2b6dc3d4}" Type="{B6FA6D8B-EEAA-47A6-8463-7F9A4F5BBB6E}" Data="&lt;xml&gt;&lt;GlobalVariables&gt;&lt;Parameter ParameterName=&quot;CVE_2021_26855&quot; Label=&quot;CVE-2021-26855&quot; ParameterType=&quot;string&quot; Value=&quot;&quot; /&gt;&lt;/GlobalVariables&gt;&lt;/xml&gt;" />
  <LinkManager xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/PolicyExecutor">
    <hashset xmlns:d2p1="http://schemas.datacontract.org/2004/07/System" />
  </LinkManager>
  <Diagnostics OriginalVersion="2.18.0.7" />
  <Activity mc:Ignorable="sads sap" x:Class="Policy Builder" xmlns="http://schemas.microsoft.com/netfx/2009/xaml/activities" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:mva="clr-namespace:Microsoft.VisualBasic.Activities;assembly=System.Activities" xmlns:p="clr-namespace:PolicyExecutor;assembly=PolicyExecutionEngine" xmlns:sads="http://schemas.microsoft.com/netfx/2010/xaml/activities/debugger" xmlns:sap="http://schemas.microsoft.com/netfx/2009/xaml/activities/presentation" xmlns:scg="clr-namespace:System.Collections.Generic;assembly=mscorlib" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml">
    <x:Members>
      <x:Property Name="PolicyGUID" Type="InArgument(x:String)" />
    </x:Members>
    <sap:VirtualizedContainerService.HintSize>504,2680</sap:VirtualizedContainerService.HintSize>
    <mva:VisualBasic.Settings>Assembly references and imported namespaces serialized as XML namespaces</mva:VisualBasic.Settings>
    <p:PolicySequence DisplayName="Policy Builder" sap:VirtualizedContainerService.HintSize="504,2680" MinRequiredVersion="2.16.0.1" mva:VisualBasic.Settings="Assembly references and imported namespaces serialized as XML namespaces">
      <p:PolicySequence.Activities>
        <p:RunPowerShellScript AssemblyName="PolicyExecutionEngine, Version=2.18.0.7, Culture=neutral, PublicKeyToken=null" DisplayName="Run PowerShell Script" sap:VirtualizedContainerService.HintSize="468,522" MinRequiredVersion="2.10.0.19" Moniker="bd63f55f-ace1-489d-91c9-55e214431839" OutPut_64="[RunPowerShellScript_OutPut_64]" Result="[RunPowerShellScript_Result]" ResultString="[RunPowerShellScript_ResultString]" Results_x64="[RunPowerShellScript_Results_x64]" RunAsCurrentLoggedOnUser="False" ScriptExecutionMethod="ExecuteDebug" TypeName="RunPowerShellScript" genArgEvent="fc32de15-d5d6-4c8a-9969-4073d063bbbf" m_bTextLinkChange="False" script="aQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAiACQAZQBuAHYAOgBQAFIATwBHAFIAQQBNAEYASQBMAEUAUwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQB4AGMAaABhAG4AZwBlACAAUwBlAHIAdgBlAHIAXABWADEANQBcAEwAbwBnAGcAaQBuAGcAXABIAHQAdABwAFAAcgBvAHgAeQAiACkAewANAAoADQAKACQAcwB0AGEAdAB1AHMAIAA9ACAASQBtAHAAbwByAHQALQBDAHMAdgAgAC0AUABhAHQAaAAgACgARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0AUABhAHQAaAAgACIAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARgBJAEwARQBTAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAHgAYwBoAGEAbgBnAGUAIABTAGUAcgB2AGUAcgBcAFYAMQA1AFwATABvAGcAZwBpAG4AZwBcAEgAdAB0AHAAUAByAG8AeAB5ACIAIAAtAEYAaQBsAHQAZQByACAAJwAqAC4AbABvAGcAJwApAC4ARgB1AGwAbABOAGEAbQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACAAJABfAC4AQQB1AHQAaABlAG4AdABpAGMAYQB0AGUAZABVAHMAZQByACAALQBlAHEAIAAnACcAIAAtAGEAbgBkACAAJABfAC4AQQBuAGMAaABvAHIATQBhAGkAbABiAG8AeAAgAC0AbABpAGsAZQAgACcAUwBlAHIAdgBlAHIASQBuAGYAbwB+ACoALwAqACcAIAB9ACAAfAAgAHMAZQBsAGUAYwB0ACAARABhAHQAZQBUAGkAbQBlACwAIABBAG4AYwBoAG8AcgBNAGEAaQBsAGIAbwB4ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA0ACgANAAoADQAKAGkAZgAoACQAcwB0AGEAdAB1AHMAKQB7AA0ACgAkAFMAZQBuAHQAaQBuAGUAbAAgAD0AIAAiAFQAaABpAHMAIABzAHkAcwB0AGUAbQAgAG0AYQB5ACAAaABhAHYAZQAgAGIAZQBlAG4AIABjAG8AbQBwAHIAbwBtAGkAcwBlAGQAIABiAHkAIABDAFYARQAtADIAMAAyADEALQAyADYAOAA1AC4AIABQAGwAZQBhAHMAZQAgAHMAZQBlACAAaAB0AHQAcABzADoALwAvAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBzAGUAYwB1AHIAaQB0AHkALwBiAGwAbwBnAC8AMgAwADIAMQAvADAAMwAvADAAMgAvAGgAYQBmAG4AaQB1AG0ALQB0AGEAcgBnAGUAdABpAG4AZwAtAGUAeABjAGgAbgBhAGcAZQAtAHMAZQByAHYAZQByAHMALwAgAGYAbwByACAAYQBkAGQAaQB0AGkAbwBuAGEAbAAgAGkAbgBmAG8AcgBtAGEAdABpAG8AbgAuACIADQAKAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAkAFMAZQBuAHQAaQBuAGUAbAANAAoAVwByAGkAdABlAC0ASABvAHMAdAAgACQAQwBWAEUAXwAyADAAMgAxAF8AMgA2ADgANQA1AA0ACgANAAoAfQANAAoARQBsAHMAZQB7AA0ACgAkAFMAZQBuAHQAaQBuAGUAbAAgAD0AIAAiAE4AbwAgAGUAbQBwAHQAeQAgAEEAdQB0AGgAZQBuAHQAaQBjAGEAdABlAGQAVQBzAGUAcgAgAHIAZQBsAGEAdABlAGQAIAB0AG8AIABDAFYARQAtADIAMAAyADEALQAyADYAOAA1ACAAZgBvAHUAbgBkACIADQAKAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAkAFMAZQBuAHQAaQBuAGUAbAANAAoAfQANAAoAfQANAAoARQBsAHMAZQB7AA0ACgAkAFMAZQBuAHQAaQBuAGUAbAA9ACAAIgBVAG4AYQBiAGwAZQAgAHQAbwAgAGwAbwBjAGEAdABlACAAJABlAG4AdgA6AFAAUgBPAEcAUgBBAE0ARgBJAEwARQBTAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAHgAYwBoAGEAbgBnAGUAIABTAGUAcgB2AGUAcgBcAFYAMQA1AFwATABvAGcAZwBpAG4AZwBcAEgAdAB0AHAAUAByAG8AeAB5AC4AIABNAGEAbgB1AGEAbAAgAGkAbgBzAHAAZQBjAHQAaQBvAG4AIAByAGUAcQB1AGkAcgBlAGQAIgANAAoAVwByAGkAdABlAC0ASABvAHMAdAAgACQAUwBlAG4AdABpAG4AZQBsAA0ACgB9AA==">
          <p:RunPowerShellScript.InArgs>
            <scg:Dictionary x:TypeArguments="x:String, p:InArg" />
          </p:RunPowerShellScript.InArgs>
          <p:RunPowerShellScript.OutArgs>
            <p:OutArg x:Key="sentinel" ArgType="string" DisplayName="sentinel" Name="sentinel">
              <p:OutArg.Arg>
                <OutArgument x:TypeArguments="x:String">[RunPowerShellScript_sentinel]</OutArgument>
              </p:OutArg.Arg>
            </p:OutArg>
          </p:RunPowerShellScript.OutArgs>
        </p:RunPowerShellScript>
        <p:IfObject CaseSensitive_Item="{x:Null}" CaseSensitive_ItemProp="{x:Null}" Condition_Item="{x:Null}" Condition_ItemProp="{x:Null}" Value_Item="{x:Null}" Value_ItemProp="{x:Null}" Variable_Item="{x:Null}" Variable_ItemProp="{x:Null}" VerboseOutput_Item="{x:Null}" VerboseOutput_ItemProp="{x:Null}" AssemblyName="PolicyExecutionEngine, Version=2.18.0.7, Culture=neutral, PublicKeyToken=null" CaseSensitive="False" CaseSensitive_DisplayArg="false" Condition="contains" Condition_DisplayArg="contains" DisplayName="If" sap:VirtualizedContainerService.HintSize="468,605" MinRequiredVersion="2.16.0.1" Moniker="fda442bd-ff03-404b-b805-f053a69754f1" Result="[IfObject_Result]" ResultString="[IfObject_ResultString]" RunAsCurrentLoggedOnUser="False" ScriptExecutionMethod="None" TypeName="IfObject" Value_DisplayArg="compromised" Value_Type="x:String" Variable="[RunPowerShellScript_sentinel]" Variable_DisplayArg="Run PowerShell Script.sentinel" Variable_Type="x:String" VerboseOutput="False" VerboseOutput_DisplayArg="" m_bTextLinkChange="False">
          <p:IfObject.IfOption>
            <p:SequenceActivity DisplayName="Then" sap:VirtualizedContainerService.HintSize="382,332" Name="SequenceActivity">
              <p:SequenceActivity.Activities>
                <p:Assignment Value_Item="{x:Null}" Value_ItemProp="{x:Null}" Variable_Item="{x:Null}" Variable_ItemProp="{x:Null}" AssemblyName="PolicyExecutionEngine, Version=2.18.0.7, Culture=neutral, PublicKeyToken=null" DisplayName="Global Variable Assignment" sap:VirtualizedContainerService.HintSize="344,182" MinRequiredVersion="2.10.0.19" Moniker="f356f3c0-f788-4cb8-8d94-26c69785506f" Result="[Assignment_Result]" ResultString="[Assignment_ResultString]" RunAsCurrentLoggedOnUser="False" ScriptExecutionMethod="None" TypeName="Assignment" Value="[RunPowerShellScript_sentinel]" Value_DisplayArg="Run PowerShell Script.sentinel" Value_Type="x:String" Variable="[CVE_2021_26855]" Variable_DisplayArg="Global Variables.CVE-2021-26855" Variable_Type="x:String" m_bTextLinkChange="False" />
              </p:SequenceActivity.Activities>
              <p:SequenceActivity.Variables>
                <Variable x:TypeArguments="x:String" Name="Assignment_ResultString" />
                <Variable x:TypeArguments="x:Double" Name="Assignment_Result" />
              </p:SequenceActivity.Variables>
            </p:SequenceActivity>
          </p:IfObject.IfOption>
          <p:IfObject.Value>
            <InArgument x:TypeArguments="x:Object">
              <p:ObjectLiteral Value="compromised" />
            </InArgument>
          </p:IfObject.Value>
        </p:IfObject>
        <p:IfObject CaseSensitive_Item="{x:Null}" CaseSensitive_ItemProp="{x:Null}" Condition_Item="{x:Null}" Condition_ItemProp="{x:Null}" Value_Item="{x:Null}" Value_ItemProp="{x:Null}" Variable_Item="{x:Null}" Variable_ItemProp="{x:Null}" VerboseOutput_Item="{x:Null}" VerboseOutput_ItemProp="{x:Null}" AssemblyName="PolicyExecutionEngine, Version=2.18.0.7, Culture=neutral, PublicKeyToken=null" CaseSensitive="False" CaseSensitive_DisplayArg="false" Condition="contains" Condition_DisplayArg="contains" DisplayName="If" sap:VirtualizedContainerService.HintSize="468,605" MinRequiredVersion="2.16.0.1" Moniker="f7045661-cd0f-4cd2-a1a6-a450646c47d9" Result="[IfObject_Result_2]" ResultString="[IfObject_ResultString_2]" RunAsCurrentLoggedOnUser="False" ScriptExecutionMethod="None" TypeName="IfObject" Value_DisplayArg="No empty AuthenticatedUser" Value_Type="x:String" Variable="[RunPowerShellScript_sentinel]" Variable_DisplayArg="Run PowerShell Script.sentinel" Variable_Type="x:String" VerboseOutput="False" VerboseOutput_DisplayArg="" m_bTextLinkChange="False">
          <p:IfObject.IfOption>
            <p:SequenceActivity DisplayName="Then" sap:VirtualizedContainerService.HintSize="382,332" Name="SequenceActivity">
              <p:SequenceActivity.Activities>
                <p:Assignment Value_Item="{x:Null}" Value_ItemProp="{x:Null}" Variable_Item="{x:Null}" Variable_ItemProp="{x:Null}" AssemblyName="PolicyExecutionEngine, Version=2.18.0.7, Culture=neutral, PublicKeyToken=null" DisplayName="Global Variable Assignment" sap:VirtualizedContainerService.HintSize="344,182" MinRequiredVersion="2.10.0.19" Moniker="52bc5ad7-d07f-45ca-b581-c47464261a64" Result="[Assignment_Result_2]" ResultString="[Assignment_ResultString_2]" RunAsCurrentLoggedOnUser="False" ScriptExecutionMethod="None" TypeName="Assignment" Value="[RunPowerShellScript_sentinel]" Value_DisplayArg="Run PowerShell Script.sentinel" Value_Type="x:String" Variable="[CVE_2021_26855]" Variable_DisplayArg="Global Variables.CVE-2021-26855" Variable_Type="x:String" m_bTextLinkChange="False" />
              </p:SequenceActivity.Activities>
              <p:SequenceActivity.Variables>
                <Variable x:TypeArguments="x:String" Name="Assignment_ResultString_2" />
                <Variable x:TypeArguments="x:Double" Name="Assignment_Result_2" />
              </p:SequenceActivity.Variables>
            </p:SequenceActivity>
          </p:IfObject.IfOption>
          <p:IfObject.Value>
            <InArgument x:TypeArguments="x:Object">
              <p:ObjectLiteral Value="No empty AuthenticatedUser" />
            </InArgument>
          </p:IfObject.Value>
        </p:IfObject>
        <p:IfObject CaseSensitive_ItemProp="{x:Null}" Condition_ItemProp="{x:Null}" Value_Item="{x:Null}" Value_ItemProp="{x:Null}" Variable_ItemProp="{x:Null}" VerboseOutput_ItemProp="{x:Null}" AssemblyName="PolicyExecutionEngine, Version=2.18.0.7, Culture=neutral, PublicKeyToken=null" CaseSensitive="False" CaseSensitive_DisplayArg="false" CaseSensitive_Item="{x:Null}" Condition="contains" Condition_DisplayArg="contains" Condition_Item="{x:Null}" DisplayName="If" sap:VirtualizedContainerService.HintSize="468,605" MinRequiredVersion="2.16.0.1" Moniker="e40001e7-c818-4488-9c71-0b5c15e60b02" Result="[IfObject_Result_1]" ResultString="[IfObject_ResultString_1]" RunAsCurrentLoggedOnUser="False" ScriptExecutionMethod="None" TypeName="IfObject" Value_DisplayArg="unable" Value_Type="x:String" Variable="[RunPowerShellScript_sentinel]" Variable_DisplayArg="Run PowerShell Script.sentinel" Variable_Item="{x:Null}" Variable_Type="x:String" VerboseOutput="False" VerboseOutput_DisplayArg="" VerboseOutput_Item="{x:Null}" m_bTextLinkChange="False">
          <p:IfObject.IfOption>
            <p:SequenceActivity DisplayName="Then" sap:VirtualizedContainerService.HintSize="382,332" Name="SequenceActivity">
              <p:SequenceActivity.Activities>
                <p:Assignment Value_Item="{x:Null}" Value_ItemProp="{x:Null}" Variable_Item="{x:Null}" Variable_ItemProp="{x:Null}" AssemblyName="PolicyExecutionEngine, Version=2.18.0.7, Culture=neutral, PublicKeyToken=null" DisplayName="Global Variable Assignment" sap:VirtualizedContainerService.HintSize="344,182" MinRequiredVersion="2.10.0.19" Moniker="ad3ce376-626c-44c2-a279-25bc802a414c" Result="[Assignment_Result_1]" ResultString="[Assignment_ResultString_1]" RunAsCurrentLoggedOnUser="False" ScriptExecutionMethod="None" TypeName="Assignment" Value="[RunPowerShellScript_sentinel]" Value_DisplayArg="Run PowerShell Script.sentinel" Value_Type="x:String" Variable="[CVE_2021_26855]" Variable_DisplayArg="Global Variables.CVE-2021-26855" Variable_Type="x:String" m_bTextLinkChange="False" />
              </p:SequenceActivity.Activities>
              <p:SequenceActivity.Variables>
                <Variable x:TypeArguments="x:String" Name="Assignment_ResultString_1" />
                <Variable x:TypeArguments="x:Double" Name="Assignment_Result_1" />
              </p:SequenceActivity.Variables>
            </p:SequenceActivity>
          </p:IfObject.IfOption>
          <p:IfObject.Value>
            <InArgument x:TypeArguments="x:Object">
              <p:ObjectLiteral Value="unable" />
            </InArgument>
          </p:IfObject.Value>
        </p:IfObject>
      </p:PolicySequence.Activities>
      <p:PolicySequence.Variables>
        <Variable x:TypeArguments="x:String" Name="RunPowerShellScript_OutPut_64" />
        <Variable x:TypeArguments="x:String" Name="RunPowerShellScript_ResultString" />
        <Variable x:TypeArguments="scg:IEnumerable(x:Object)" Name="RunPowerShellScript_Results_x64" />
        <Variable x:TypeArguments="x:Double" Name="RunPowerShellScript_Result" />
        <Variable x:TypeArguments="x:String" Name="IfObject_ResultString_1" />
        <Variable x:TypeArguments="x:Double" Name="IfObject_Result_1" />
        <Variable x:TypeArguments="x:String" Name="RunPowerShellScript_sentinel" />
        <Variable x:TypeArguments="x:String" Name="IfObject_ResultString" />
        <Variable x:TypeArguments="x:Double" Name="IfObject_Result" />
        <Variable x:TypeArguments="x:String" Name="IfObject_ResultString_2" />
        <Variable x:TypeArguments="x:Double" Name="IfObject_Result_2" />
        <Variable x:TypeArguments="x:String" Name="CVE_2021_26855" />
      </p:PolicySequence.Variables>
    </p:PolicySequence>
  </Activity>
</Policy>
```

# CVE-2021-26855 IOC