Vulnerability-Lookup

CVE-2022-41082 (GCVE-0-2022-41082)

Vulnerability from cvelistv5 – Published: 2022-10-03 00:00 – Updated: 2025-10-21 23:15

CISA Previdian

Title

Microsoft Exchange Server Remote Code Execution Vulnerability

Summary

Microsoft Exchange Server Remote Code Execution Vulnerability

Severity

8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-04 17:55 UTC

CWE

Remote Code Execution
CWE-502 - Deserialization of Untrusted Data

Assigner

microsoft mitre root Scorecard

References

8 references

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory
https://www.vicarius.io/vsociety/posts/cve-2022-4…
https://www.vicarius.io/vsociety/posts/cve-2022-4…
https://portal.msrc.microsoft.com/en-US/security-…	x_transferred
https://www.kb.cert.org/vuls/id/915563	third-party-advisoryx_transferred
http://packetstormsecurity.com/files/170066/Micro…	x_transferred
https://www.secpod.com/blog/microsoft-november-20…	x_transferred
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

5 products

Vendor	Product	Version
Microsoft	Microsoft Exchange Server 2013 Cumulative Update 23	Affected: 15.00.0 , < 15.00.1497.044 (custom)
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 22	Affected: 15.0.0 , < 15.01.2375.037 (custom)
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 11	Affected: 15.02.0 , < 15.02.0986.036 (custom)
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 12	Affected: 15.02.0 , < 15.02.1118.020 (custom)
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	Affected: 15.01.0 , < 15.01.2507.016 (custom)

Date Public

2022-09-30 07:00

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 3fa88d2b-d04e-4a30-b04d-1f9813add4e4

Vulnerability ID: CVE-2022-41082

Status: Confirmed

Status Updated: 2022-09-30 02:00 CEST

Exploited: Yes

Timestamps

First Seen: 2022-09-30

Asserted: 2022-09-30

Scope

Notes: Microsoft Exchange Server Remote Code Execution Vulnerability | Affected: Microsoft / Exchange Server | Description: Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-21 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; https://nvd.nist.gov/vuln/detail/CVE-2022-41082

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-502
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Exchange Server
Due Date	2022-10-21
Date Added	2022-09-30
Vendorproject	Microsoft
Vulnerabilityname	Microsoft Exchange Server Remote Code Execution Vulnerability
Knownransomwarecampaignuse	Known

References

CVE-2022-41082

Created: 2026-10-02 08:09 CEST | Updated: 2026-10-02 08:09 CEST

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 5d5f8339-a578-40c1-87b6-0fa902bbc434

Vulnerability ID: CVE-2022-41082

Status: Confirmed

Status Updated: 2022-09-30 02:00 CEST

Exploited: Yes

Timestamps

First Seen: 2022-09-30

Asserted: 2022-09-30

Scope

Notes: Microsoft Exchange Server Remote Code Execution Vulnerability | Affected: Microsoft / Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23 | CVSS: 8.0 (HIGH) | EPSS: 0.9997 | Used in malware: yes | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Confirmed Compromise

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	Microsoft Exchange Server Remote Code Execution Vulnerability
Cve Id	CVE-2022-41082
Vendor	Microsoft
Ghsa Id	None
Product	Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22, Microsoft Exchange Server 2019 Cumulative Update 11, Microsoft Exchange Server 2019 Cumulative Update 12, Microsoft Exchange Server 2016 Cumulative Update 23
Added Date	2022-09-30T00:00:00.000Z
Cvss Score	8.0
Epss Score	0.9997
Previous Ids
Cvss Severity	HIGH
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.99977
Used In Malware	yes
Vulnerability Id	CVE-2022-41082
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	False

References

Created: 2026-10-02 09:11 CEST | Updated: 2026-10-02 09:11 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-03-07T16:08:48.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-script"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-script"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082"
          },
          {
            "name": "VU#915563",
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/915563"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-41082",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T17:55:49.337641Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-09-30",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-502",
                "description": "CWE-502 Deserialization of Untrusted Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:15:33.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-09-30T00:00:00.000Z",
            "value": "CVE-2022-41082 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2013 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.00.1497.044",
              "status": "affected",
              "version": "15.00.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 22",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2375.037",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 11",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.0986.036",
              "status": "affected",
              "version": "15.02.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 12",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.1118.020",
              "status": "affected",
              "version": "15.02.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2507.016",
              "status": "affected",
              "version": "15.01.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*",
                  "versionEndExcluding": "15.00.1497.044",
                  "versionStartIncluding": "15.00.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_22:*:*:*:*:*:*",
                  "versionEndExcluding": "15.01.2375.037",
                  "versionStartIncluding": "15.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_11:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.0986.036",
                  "versionStartIncluding": "15.02.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_12:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.1118.020",
                  "versionStartIncluding": "15.02.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*",
                  "versionEndExcluding": "15.01.2507.016",
                  "versionStartIncluding": "15.01.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2022-09-30T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T16:10:49.607Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082"
        }
      ],
      "title": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2022-41082",
    "datePublished": "2022-10-03T00:00:00.000Z",
    "dateReserved": "2022-09-19T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:15:33.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-41082",
      "date": "2026-10-04",
      "epss": "0.9997",
      "percentile": "0.99978"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "platforms": [
                  "x64-based Systems"
                ],
                "product": "Microsoft Exchange Server 2013 Cumulative Update 23",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "15.00.1497.044",
                    "status": "affected",
                    "version": "15.00.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "x64-based Systems"
                ],
                "product": "Microsoft Exchange Server 2016 Cumulative Update 22",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "15.01.2375.037",
                    "status": "affected",
                    "version": "15.0.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "x64-based Systems"
                ],
                "product": "Microsoft Exchange Server 2019 Cumulative Update 11",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "15.02.0986.036",
                    "status": "affected",
                    "version": "15.02.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "x64-based Systems"
                ],
                "product": "Microsoft Exchange Server 2019 Cumulative Update 12",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "15.02.1118.020",
                    "status": "affected",
                    "version": "15.02.0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "platforms": [
                  "x64-based Systems"
                ],
                "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
                "vendor": "Microsoft",
                "versions": [
                  {
                    "lessThan": "15.01.2507.016",
                    "status": "affected",
                    "version": "15.01.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "secure@microsoft.com"
          }
        ],
        "cisaActionDue": "2022-10-21",
        "cisaExploitAdd": "2022-09-30",
        "cisaRequiredAction": "Apply updates per vendor instructions.",
        "cisaVulnerabilityName": "Microsoft Exchange Server Remote Code Execution Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
                    "matchCriteriaId": "DA166F2A-D83B-4D50-AD0B-668D813E0585",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*",
                    "matchCriteriaId": "449CE85B-E599-44D3-A7C1-5133F6A55E86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
                    "matchCriteriaId": "FF76AEDA-E574-40ED-B64F-8FDEF8CAC802",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*",
                    "matchCriteriaId": "435343A4-BF10-461A-ABF2-D511A5FBDA75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
                    "matchCriteriaId": "B23C8E3E-5243-4DA6-B9AA-F6053084B55E",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
          },
          {
            "lang": "es",
            "value": "Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota en Microsoft Exchange Server"
          }
        ],
        "id": "CVE-2022-41082",
        "lastModified": "2026-06-17T05:02:33.460",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 5.9,
              "source": "secure@microsoft.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-41082",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T17:55:49.337641Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2022-10-03T01:15:08.843",
        "references": [
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "US Government Resource"
            ],
            "url": "https://www.kb.cert.org/vuls/id/915563"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-script"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-script"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082"
          }
        ],
        "sourceIdentifier": "secure@microsoft.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-03-07T16:08:48.794Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-script"
              },
              {
                "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-script"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082"
              },
              {
                "name": "VU#915563",
                "tags": [
                  "third-party-advisory",
                  "x_transferred"
                ],
                "url": "https://www.kb.cert.org/vuls/id/915563"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/"
              }
            ],
            "title": "CVE Program Container",
            "x_generator": {
              "engine": "ADPogram 0.0.1"
            }
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-41082",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-04T17:55:49.337641Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2022-09-30",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082"
                  },
                  "type": "kev"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-502",
                    "description": "CWE-502 Deserialization of Untrusted Data",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-04T17:55:32.763Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2022-09-30T00:00:00.000Z",
                "value": "CVE-2022-41082 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "platforms": [
                "x64-based Systems"
              ],
              "product": "Microsoft Exchange Server 2013 Cumulative Update 23",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "15.00.1497.044",
                  "status": "affected",
                  "version": "15.00.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "x64-based Systems"
              ],
              "product": "Microsoft Exchange Server 2016 Cumulative Update 22",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "15.01.2375.037",
                  "status": "affected",
                  "version": "15.0.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "x64-based Systems"
              ],
              "product": "Microsoft Exchange Server 2019 Cumulative Update 11",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "15.02.0986.036",
                  "status": "affected",
                  "version": "15.02.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "x64-based Systems"
              ],
              "product": "Microsoft Exchange Server 2019 Cumulative Update 12",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "15.02.1118.020",
                  "status": "affected",
                  "version": "15.02.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "platforms": [
                "x64-based Systems"
              ],
              "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
              "vendor": "Microsoft",
              "versions": [
                {
                  "lessThan": "15.01.2507.016",
                  "status": "affected",
                  "version": "15.01.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*",
                      "versionEndExcluding": "15.00.1497.044",
                      "versionStartIncluding": "15.00.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_22:*:*:*:*:*:*",
                      "versionEndExcluding": "15.01.2375.037",
                      "versionStartIncluding": "15.0.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_11:*:*:*:*:*:*",
                      "versionEndExcluding": "15.02.0986.036",
                      "versionStartIncluding": "15.02.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_12:*:*:*:*:*:*",
                      "versionEndExcluding": "15.02.1118.020",
                      "versionStartIncluding": "15.02.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:microsoft:exchange_server:*:cumulative_update_23:*:*:*:*:*:*",
                      "versionEndExcluding": "15.01.2507.016",
                      "versionStartIncluding": "15.01.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "datePublic": "2022-09-30T07:00:00.000Z",
          "descriptions": [
            {
              "lang": "en-US",
              "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Remote Code Execution",
                  "lang": "en-US",
                  "type": "Impact"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-03-11T16:10:49.607Z",
            "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            "shortName": "microsoft"
          },
          "references": [
            {
              "name": "Microsoft Exchange Server Remote Code Execution Vulnerability",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082"
            }
          ],
          "title": "Microsoft Exchange Server Remote Code Execution Vulnerability"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "assignerShortName": "microsoft",
        "cveId": "CVE-2022-41082",
        "datePublished": "2022-10-03T00:00:00.000Z",
        "dateReserved": "2022-09-19T00:00:00.000Z",
        "dateUpdated": "2025-10-21T23:15:33.797Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2022-06033 (CVE-2022-41082)

Vulnerability from fstec – Published: 2022-09-30 – Updated: 2024-09-13 – View on bdu.fstec.ru Exploit publicly available Yes No remediation information

CISA Previdian

Title

Уязвимость почтового сервера Microsoft Exchange Server, связанная с ошибками управления генерацией кода, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость почтового сервера Microsoft Exchange Server связана с ошибками управления генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Injection

Incidents

Yes

Remediation

Organisational measures

CWE

CWE-94 - Неверное управление генерацией кода (Внедрение кода)

Aliases

CVE-2022-41082

References

2 references

URL
https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-…
http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Re…

Impacted products

1 product from 1 vendor

Vendors

Microsoft Corp

Products

Microsoft Exchange Server

Versions

2016 (Microsoft Exchange Server), 2013 (Microsoft Exchange Server), 2019 (Microsoft Exchange Server)

Product types

Application software

Mitigations

Компенсирующие меры: - выполнение следующих шагов: 1. Открыть диспетчер IIS. 2. Развернуть веб-сайт по умолчанию. 3. Выбрать «Автообнаружение». 4. В представлении функций нажать «Перезаписать URL». 5. На панели «Действия» справа нажать «Добавить правила». 6. Выбрать «Блокировка запроса» и нажать «ОК». 7. Добавить строку «.*autodiscover\.json.*\@.*Powershell.*» (без кавычек) и нажать «ОК». 8. Развернуть правило и выбрать правило с шаблоном «.*autodiscover\.json.*\@.*Powershell.*» и нажать «Изменить» в разделе «Условия». Изменить ввод условия с {URL} на {REQUEST_URI}; - блокировка HTTP-портов 5985 и 5986. Для проверки компрометации сервера запустить следующую команду PowerShell: Get-ChildItem -Recurse -Path <Path_IIS_Logs> -Filter "*.log" | Select-String -Pattern 'powershell.*autodiscover\.json.*\@.*200' Использование рекомендаций: https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "2016 (Microsoft Exchange Server), 2013 (Microsoft Exchange Server), 2019 (Microsoft Exchange Server)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0448\u0430\u0433\u043e\u0432:\n1. \u041e\u0442\u043a\u0440\u044b\u0442\u044c \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440 IIS.\n2. \u0420\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432\u0435\u0431-\u0441\u0430\u0439\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n3. \u0412\u044b\u0431\u0440\u0430\u0442\u044c \u00ab\u0410\u0432\u0442\u043e\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435\u00bb.\n4. \u0412 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u043d\u0430\u0436\u0430\u0442\u044c \u00ab\u041f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c URL\u00bb.\n5. \u041d\u0430 \u043f\u0430\u043d\u0435\u043b\u0438 \u00ab\u0414\u0435\u0439\u0441\u0442\u0432\u0438\u044f\u00bb \u0441\u043f\u0440\u0430\u0432\u0430 \u043d\u0430\u0436\u0430\u0442\u044c \u00ab\u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u00bb.\n6. \u0412\u044b\u0431\u0440\u0430\u0442\u044c \u00ab\u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u00bb \u0438 \u043d\u0430\u0436\u0430\u0442\u044c \u00ab\u041e\u041a\u00bb.\n7. \u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u0441\u0442\u0440\u043e\u043a\u0443 \u00ab.*autodiscover\\.json.*\\@.*Powershell.*\u00bb (\u0431\u0435\u0437 \u043a\u0430\u0432\u044b\u0447\u0435\u043a) \u0438 \u043d\u0430\u0436\u0430\u0442\u044c \u00ab\u041e\u041a\u00bb.\n8. \u0420\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0438 \u0432\u044b\u0431\u0440\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0441 \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u043c \u00ab.*autodiscover\\.json.*\\@.*Powershell.*\u00bb \u0438 \u043d\u0430\u0436\u0430\u0442\u044c \u00ab\u0418\u0437\u043c\u0435\u043d\u0438\u0442\u044c\u00bb \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0435 \u00ab\u0423\u0441\u043b\u043e\u0432\u0438\u044f\u00bb.\n\u0418\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u0432\u043e\u0434 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0441 {URL} \u043d\u0430 {REQUEST_URI};\n- \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 HTTP-\u043f\u043e\u0440\u0442\u043e\u0432 5985 \u0438 5986.\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 PowerShell:\nGet-ChildItem -Recurse -Path \u003cPath_IIS_Logs\u003e -Filter \"*.log\" | Select-String -Pattern \u0027powershell.*autodiscover\\.json.*\\@.*200\u0027\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "30.09.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "13.09.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "30.09.2022",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-06033",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-41082",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Microsoft Exchange Server",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430 (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430) (CWE-94)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Microsoft Exchange Server \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0435\u0439 \u043a\u043e\u0434\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u043c\u0435\u0440\u044b",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/\nhttp://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-94",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CERTFR-2022-ALE-008

Vulnerability from certfr_alerte - Published: 2022-09-30 - Updated: 2023-03-14

[Mise à jour du 09 novembre 2022] L'éditeur a publié un correctif (cf. section solution).

En date du 29 septembre 2022, Microsoft a indiqué l'existence de deux vulnérabilités, de type zéro-jour, au sein de Windows Exchange 2013, 2016 et 2019.

Ces vulnérabilités sont les suivantes :

CVE-2022-41040 : Vulnérabilité de type injection de requêtes forgées côté serveur (Server Side Request Forgery, SSRF) exploitable par un attaquant authentifié ;
CVE-2022-41082 : Vulnérabilité permettant à un attaquant authentifié d'exécuter du code arbitraire à distance.

Dans le cadre d'une attaque, la CVE-2022-41040 peut permettre à un attaquant d'exploiter à distance la CVE-2022-41082. Selon l'éditeur, ces deux vulnérabilités ne sont exploitables que si l'attaquant est déjà authentifié. Un correctif spécifique est en cours de développement par Microsoft.

Ces vulnérabilités doivent faire l'objet d'une prise en compte immédiate, car elles ont été utilisées dans le cadre d'attaques ciblées. Le CERT-FR n'a pour le moment pas connaissance des conditions ayant permis aux attaquants d'obtenir un accès authentifié sur les serveurs ciblés.

Le CERT-FR a connaissance de codes d'exploitation publics pour la CVE-2022-41040.

Le CERT-FR a connaissance d'incidents en France impliquant l'exploitation de ces vulnérabilités.

Contournement provisoire

En attendant la publication des correctifs, le CERT-FR recommande d'appliquer immédiatement les mesures d'atténuation proposées par Microsoft [1].

L'éditeur recommande fortement de désactiver l’accès à PowerShell à distance pour les utilisateurs non administrateurs [3]. Le CERT-FR recommande l'application de cette contre-mesure car il s'agit de la protection la plus efficace identifiée à ce jour. Il conviendra de tester la configuration afin d'identifier les éventuels effets de bord sur les procédures automatisées basées sur Powershell.

Par ailleurs, et de façon complémentaire, Microsoft a publié un code PowerShell permettant d'appliquer les mesures d'atténuation pour la CVE-2022-41040 (réécriture de l'URL) [2]. De plus, une mise à jour de l'outil EEMS (Exchange Emergency Mitigation Service), ainsi que des éléments pour l'outil AMSI (AntiMalware Scan Interface) ont été proposés par Microsoft.

Le code PowerShell de Microsoft permettant d'appliquer la mesure d'atténuation via le module URL Rewrite a été mis à jour pour renforcer son efficacité contre des variations de la requête malveillante initialement observée [2]. Afin d'appliquer cette modification, il est nécessaire de télécharger puis relancer ce nouveau code ou modifier directement la règle dans le module URL Rewrite avec la valeur suivante : ".*autodiscover\.json.*Powershell.*".

Afin de prévenir tout type de coutournement de la règle ".*autodiscover\.json.*Powershell.*" par le biais d'encodage, le CERT-FR rappelle qu'il faut modifier la condition d'entrée de la règle susmentionnée avec la valeur suivante : {UrlDecode:{REQUEST_URI}}. Pour plus d'informations, veuillez-vous référer à l'étape 10 du blog de Microsoft [1].

Le Microsoft Patch Tuesday du 11 octobre 2022 ne propose aucun correctif pour ces vulnérabilités. Il est essentiel de maintenir l'application des contournements mentionnés ci-avant.

Détection

Le billet de blogue de l'éditeur documente quelques éléments d'aide à la détection de ces vulnérabilités [1].

Le CERT-FR recommande de réaliser une analyse approfondie des journaux réseau des serveurs IIS (sauvegardés par défaut dans le dossier : %SystemDrive%\inetpub\logs\LogFiles). Les commandes suivantes permettent d'identifier une exploitation de la vulnérabilité CVE-2022-41040 :

sur un système Windows : Get-ChildItem -Recurse -Path <Path_IIS_Logs> -Filter "*.log" | Select-String -Pattern '/powershell.*autodiscover.json.*200';
sur un système Linux : cat <Path_IIS_Logs>/*.log | grep -i -e '/powershell.*autodiscover.json.*200'.

Si une répartition de charge (load-balancing) est mise en œuvre, ces commandes doivent être appliquées sur les journaux de chacun des nœuds. Il est possible d'identifier une exploitation réussie de la CVE-2022-41040 si, à la suite de la première requête, une seconde requête HTTP de type POST commençant par le motif : /PowerShell a été exécutée par le serveur. Dans ce cas là, une analyse forensique des serveurs Exchange doit être engagée.

En cas de suspicion de compromission, les bons réflexes en cas d'intrusion sur votre système d'information sont rappelés ici.

Solution

[Mise à jour du 09 novembre 2022] Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation [4]).

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft Exchange Serveur 2013 toutes versions
Microsoft	N/A	Microsoft Exchange Serveur 2016 toutes versions
Microsoft	N/A	Microsoft Exchange Serveur 2019 toutes versions

References

Title

Publication Time

CERTFR-2022-AVI-876

Vulnerability from certfr_avis - Published: 2022-10-03 - Updated: 2022-10-03

De multiples vulnérabilités ont été découvertes dans Microsoft Exchange Server. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft Exchange Serveur 2013 toutes versions
Microsoft	N/A	Microsoft Exchange Serveur 2016 toutes versions
Microsoft	N/A	Microsoft Exchange Serveur 2019 toutes versions

References

Title

Publication Time

EUVD-2026-255809

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 06:58

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T06:58:22.513557+00:00",
  "id": "EUVD-2026-255809"
}

FKIE_CVE-2022-41082

Vulnerability from fkie_nvd - Published: 2022-10-03 01:15 - Updated: 2026-06-17 05:02

CISA Previdian

Severity

8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Microsoft Exchange Server Remote Code Execution Vulnerability

References

URL	Tags
secure@microsoft.com	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html	Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.kb.cert.org/vuls/id/915563	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-script	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-script	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082	US Government Resource

Impacted products

Vendor	Product	Version
microsoft	exchange_server	2013
microsoft	exchange_server	2016
microsoft	exchange_server	2016
microsoft	exchange_server	2019
microsoft	exchange_server	2019

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2013 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.00.1497.044",
              "status": "affected",
              "version": "15.00.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 22",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2375.037",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 11",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.0986.036",
              "status": "affected",
              "version": "15.02.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 12",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.1118.020",
              "status": "affected",
              "version": "15.02.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2507.016",
              "status": "affected",
              "version": "15.01.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "cisaActionDue": "2022-10-21",
  "cisaExploitAdd": "2022-09-30",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Microsoft Exchange Server Remote Code Execution Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
              "matchCriteriaId": "DA166F2A-D83B-4D50-AD0B-668D813E0585",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*",
              "matchCriteriaId": "449CE85B-E599-44D3-A7C1-5133F6A55E86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
              "matchCriteriaId": "FF76AEDA-E574-40ED-B64F-8FDEF8CAC802",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*",
              "matchCriteriaId": "435343A4-BF10-461A-ABF2-D511A5FBDA75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
              "matchCriteriaId": "B23C8E3E-5243-4DA6-B9AA-F6053084B55E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
    },
    {
      "lang": "es",
      "value": "Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota en Microsoft Exchange Server"
    }
  ],
  "id": "CVE-2022-41082",
  "lastModified": "2026-06-17T05:02:33.460",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-41082",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-04T17:55:49.337641Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-10-03T01:15:08.843",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.kb.cert.org/vuls/id/915563"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-script"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-script"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-CG2V-9V73-CCWP

Vulnerability from github – Published: 2022-10-04 00:00 – Updated: 2025-10-22 00:32

Details

Microsoft Exchange Server Remote Code Execution Vulnerability.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-41082"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-03T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Exchange Server Remote Code Execution Vulnerability.",
  "id": "GHSA-cg2v-9v73-ccwp",
  "modified": "2025-10-22T00:32:37Z",
  "published": "2022-10-04T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41082"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/915563"
    },
    {
      "type": "WEB",
      "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-script"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-script"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-41082

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Microsoft Exchange Server Remote Code Execution Vulnerability.

Aliases

CVE-2022-41082

Aliases

CVE-2022-41082

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-41082",
    "id": "GSD-2022-41082"
  },
  "gsd": {
    "affected": [
      {
        "package": {
          "ecosystem": "Microsoft",
          "name": "Exchange Server 2019"
        },
        "ranges": [
          {
            "events": [
              {
                "introduced": "Cumulative Update 11"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "versions": [
          "Microsoft Exchange Server 2019 Cumulative Update 11",
          "Microsoft Exchange Server 2019 Cumulative Update 12"
        ]
      },
      {
        "package": {
          "ecosystem": "Microsoft",
          "name": "Exchange Server 2016"
        },
        "ranges": [
          {
            "events": [
              {
                "introduced": "Cumulative Update 22"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "versions": [
          "Microsoft Exchange Server 2016 Cumulative Update 22",
          "Microsoft Exchange Server 2016 Cumulative Update 23"
        ]
      },
      {
        "package": {
          "ecosystem": "Microsoft",
          "name": "Exchange Server 2013"
        },
        "ranges": [
          {
            "events": [
              {
                "introduced": "Cumulative Update 23"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "versions": [
          "Microsoft Exchange Server 2013 Cumulative Update 23"
        ]
      }
    ],
    "description": "It was originally reported that an undisclosed flaw in Microsoft Exchange Server version 2019 and possibly earlier allowed for remote code execution. Confirmation was not available at the time of the release of the original GSD identifiers (GSD-2022-1006324 and GSD-2022-1006325) however, since then, Microsoft has confirmed that these two issues can be combined to gain remote code execution (an SSRF and a Remote Code Execution via Powershell). Microsoft has assigned CVE ID\u0027s for these two issues, as such the original GSD Identifiers have been withdrawn, and the corresponding GSD ID\u0027s for the CVE ID\u0027s have been populated with data (the file you are currently reading). \n\n This issue was originally reported and also reportedly confirmed as ZDI-CAN-18333 (CVSS score of 8.8) and ZDI-CAN-18802 (CVSS score of 6.3). \n\n Microsoft now reports the following: \n\n # Summary \n\n Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF)  vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker. \n\n At this time, Microsoft is aware of limited targeted attacks using the two vulnerabilities to get into users\u2019 systems.  In these attacks, CVE-2022-41040 can enable an authenticated attacker to remotely trigger CVE-2022-41082. It should be noted that authenticated access to the vulnerable Exchange Server is necessary to successfully exploit either of the two vulnerabilities. \n\n We are working on an accelerated timeline to release a fix. Until then, we\u2019re providing the mitigations and detection guidance below to help customers protect themselves from these attacks. \n\n Microsoft Exchange Online has detections and mitigation in place to protect customers. Microsoft is also monitoring these already deployed detections for malicious activity and will take necessary response actions to protect customers. \n\n We will continue to provide updates here to help keep customers informed. \n\n # Mitigations \n\n Mitigation information is available at https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/ \n\n # Detections \n\n Detection information is available at https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/ \n\n # Updates \n\n September 30, 2022 updates: \n\n Microsoft created a script for the URL Rewrite mitigation steps and modified step 6 in the Mitigations section. \n Antimalware Scan Interface (AMSI) guidance, and auditing AV exclusions to optimize detection, and blocking of the Exchange vulnerability exploitation. \n Microsoft Sentinel hunting queries \n",
    "id": "GSD-2022-41082",
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "modified": "2022-09-30T16:52:13.370068648Z",
    "osvSchema": {
      "aliases": [
        "CVE-2022-41082"
      ],
      "details": "Microsoft Exchange Server Remote Code Execution Vulnerability.",
      "id": "GSD-2022-41082",
      "modified": "2023-12-13T01:19:33.112301Z",
      "schema_version": "1.4.0"
    },
    "references": [
      {
        "type": "ADVISORY",
        "url": "https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html"
      },
      {
        "type": "ADVISORY",
        "url": "https://twitter.com/GossiTheDog/status/1575580072961982464"
      },
      {
        "type": "ADVISORY",
        "url": "https://doublepulsar.com/proxynotshell-the-story-of-the-claimed-zero-day-in-microsoft-exchange-5c63d963a9e9"
      },
      {
        "type": "ADVISORY",
        "url": "https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/"
      },
      {
        "type": "ADVISORY",
        "url": "https://twitter.com/blackorbird/status/1575521156966535168"
      },
      {
        "type": "ADVISORY",
        "url": "https://www.cisa.gov/uscert/ncas/current-activity/2022/09/30/microsoft-releases-guidance-zero-day-vulnerabilities-microsoft"
      },
      {
        "type": "ADVISORY",
        "url": "https://www.rapid7.com/blog/post/2022/09/29/suspected-post-authentication-zero-day-vulnerabilities-in-microsoft-exchange-server/"
      },
      {
        "type": "WEB",
        "url": "https://twitter.com/GossiTheDog/status/1575762721353916417"
      },
      {
        "type": "WEB",
        "url": "https://github.com/VNCERT-CC/0dayex-checker"
      },
      {
        "type": "WEB",
        "url": "https://www.reddit.com/r/netsec/comments/xs5xsz/vncertcc_has_just_developed_a_tool_to_check/"
      },
      {
        "type": "WEB",
        "url": "https://krebsonsecurity.com/2022/09/microsoft-two-new-0-day-flaws-in-exchange-server/"
      }
    ],
    "related": [
      "GSD-2022-41040"
    ],
    "schema_version": "1.3.1",
    "severity": [
      {
        "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
        "type": "CVSS_V3"
      }
    ],
    "summary": "Microsoft Exchange Remote Code Execution via PowerShell in 2019 and earlier"
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2022-41082",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Microsoft Exchange Server 2013 Cumulative Update 23",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.00.0",
                          "version_value": "15.00.1497.044"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2016 Cumulative Update 22",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.0.0",
                          "version_value": "15.01.2375.037"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2019 Cumulative Update 11",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.02.0",
                          "version_value": "15.02.0986.036"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2019 Cumulative Update 12",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.02.0",
                          "version_value": "15.02.1118.020"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Microsoft Exchange Server 2016 Cumulative Update 23",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "15.01.0",
                          "version_value": "15.01.2507.016"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Remote Code Execution"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082",
            "refsource": "MISC",
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082"
          },
          {
            "name": "https://www.kb.cert.org/vuls/id/915563",
            "refsource": "MISC",
            "url": "https://www.kb.cert.org/vuls/id/915563"
          },
          {
            "name": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html"
          },
          {
            "name": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/",
            "refsource": "MISC",
            "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "cisaActionDue": "2022-10-21",
        "cisaExploitAdd": "2022-09-30",
        "cisaRequiredAction": "Apply updates per vendor instructions.",
        "cisaVulnerabilityName": "Microsoft Exchange Server Remote Code Execution Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*",
                    "matchCriteriaId": "DA166F2A-D83B-4D50-AD0B-668D813E0585",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*",
                    "matchCriteriaId": "449CE85B-E599-44D3-A7C1-5133F6A55E86",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*",
                    "matchCriteriaId": "FF76AEDA-E574-40ED-B64F-8FDEF8CAC802",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*",
                    "matchCriteriaId": "435343A4-BF10-461A-ABF2-D511A5FBDA75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*",
                    "matchCriteriaId": "B23C8E3E-5243-4DA6-B9AA-F6053084B55E",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Microsoft Exchange Server Remote Code Execution Vulnerability"
          },
          {
            "lang": "es",
            "value": "Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota en Microsoft Exchange Server"
          }
        ],
        "id": "CVE-2022-41082",
        "lastModified": "2023-12-20T20:15:18.737",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 5.9,
              "source": "secure@microsoft.com",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-10-03T01:15:08.843",
        "references": [
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Third Party Advisory",
              "US Government Resource"
            ],
            "url": "https://www.kb.cert.org/vuls/id/915563"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/"
          }
        ],
        "sourceIdentifier": "secure@microsoft.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

MSRC_CVE-2022-41082

Vulnerability from csaf_microsoft - Published: 2022-09-13 07:00 - Updated: 2022-11-08 08:00

Summary

Microsoft Exchange Server Remote Code Execution Vulnerability

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2022-41082.

CVE-2022-41082

8.0 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Fixed: 5 products Known affected: 5 products

https://support.microsoft.com/help/5019758

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-41082 (GCVE-0-2022-41082)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Confirmed Compromise Confidence: 70% Source: previdian

Details

References

BDU:2022-06033 (CVE-2022-41082)

CERTFR-2022-ALE-008

Contournement provisoire

Détection

Solution

CERTFR-2022-AVI-876

Solution

EUVD-2026-255809

FKIE_CVE-2022-41082

GHSA-CG2V-9V73-CCWP

GSD-2022-41082

MSRC_CVE-2022-41082

Tags

Sightings

Nomenclature

Related by attack behaviour