CVE-2022-41080: high-severity vulnerability in Microsoft Exchange Server 2013 Cumulative…
Microsoft Exchange Server Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply updates per vendor instructions.
A flaw in Microsoft Exchange Server allows an authenticated attacker to gain higher system privileges than they should have. This is dangerous because an attacker with basic access could potentially take full control of the email server.
This elevation of privilege vulnerability in Microsoft Exchange Server affects authenticated users and can be exploited through the Exchange management interface or OWA (Outlook Web Access). Successful exploitation allows an attacker to escalate from standard user privileges to administrative privileges, compromising the integrity and confidentiality of the entire Exchange infrastructure.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.