Microsoft Exchange Server Elevation of Privilege Vulnerability

cisa required action Apply updates per vendor instructions.

1. 2022-09-28 First public exploit (Metasploit exploit/windows/http/exchange_proxynotshell_rce)
2. 2022-09-30 Added to CISA KEV
3. 2022-10-03 Published
4. 2022-10-21 CISA patch deadline
5. 2022-11-08 0-day patched (Project Zero)
6. 2024-02-23 CISA SSVC: exploitation active

Added

4 y ago (2022-09-30)

Patch by

2022-10-21 (4 y ago)

Ransomware

Known to be used in ransomware campaigns

Required action

Apply updates per vendor instructions.

Vendor, product

Microsoft, Exchange Server

CISA name

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Patched

2022-11-08

Details

project zero tracker

Groups reported to have exploited it in intrusions.

• PLAY ransomware gang

reported by cisa.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

total

Assessed

2 y ago (2024-02-23)

99.96% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/http/exchange_proxynotshell_rce Microsoft Exchange ProxyNotShell RCE metasploit exploit, excellent rank, 2022-09-28
• packetstormsecurity.com http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

• Microsoft Microsoft Exchange Server 2013 Cumulative Update 23
• Microsoft Microsoft Exchange Server 2016 Cumulative Update 22
• Microsoft Microsoft Exchange Server 2019 Cumulative Update 11
• Microsoft Microsoft Exchange Server 2019 Cumulative Update 12
• Microsoft Microsoft Exchange Server 2016 Cumulative Update 23

Weakness

• CWE-918 Server-Side Request Forgery

Technology feeds

• Microsoft Exchange rss critical rss

• msrc.microsoft.com /update-guide/vulnerability/CVE-2022-41040

  vendor-advisory, patch

• portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2022-41040

  mitigation, patch, vendor-advisory

• packetstormsecurity.com /files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html

  exploit, third-party-advisory, vdb-entry

• kb.cert.org /vuls/id/915563

  third-party-advisory, us-government-resource

• secpod.com /blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/

  third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41040

  government-resource, us-government-resource

• CVE List CVE-2022-41040
• NVD CVE-2022-41040

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.