CVE-2022-41040highunder attackransomwareCWE-918

CVE-2022-41040: high-severity vulnerability in Microsoft Exchange Server 2013 Cumulative…

Microsoft Exchange Server Elevation of Privilege Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Exchange Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 2 threat group(s) use it.

ssvc Actcvss 8.8epss 100%
from disclosure to weaponsame day
Published on NVDOct 3
1st PoCOct 2
metasploitSep 28
CISA KEVSep 30
Who exploits it — 2

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateEmber Bear🇷🇺 MITRE ATT&CK
RansomwarePlay MITRE ATT&CK
Action required by CISAfederal deadline: 2022-10-21

Apply updates per vendor instructions.

In short

A vulnerability in Microsoft Exchange Server allows an authenticated attacker to bypass security restrictions and gain elevated privileges on the server. This flaw could enable an attacker to take control of the email system and access sensitive data.

Technical detail

CWE-918 (Server-Side Request Forgery) vulnerability in Exchange Server allows authenticated users to bypass authentication controls through improper validation of requests. An attacker with valid Exchange credentials can escalate privileges by manipulating backend server communications, potentially leading to remote code execution and complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Affected products
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23Microsoft · Microsoft Exchange Server 2016 Cumulative Update 22Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23Microsoft · Microsoft Exchange Server 2019 Cumulative Update 11Microsoft · Microsoft Exchange Server 2019 Cumulative Update 12
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Microsoft Exchange Server 2013 Cumulative…

In the same product, most dangerous first.

CVE-2021-34473CRITICALMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2021-26855CRITICALMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2021-34523CRITICALMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2022-41082HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2021-27065HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 99.9%KEVCVE-2021-31207MEDIUMMicrosoft Exchange Server Security Feature Bypass VulnerabilityEPSS 99.8%KEV