CVE-2022-41082: high-severity vulnerability in Microsoft Exchange Server 2013 Cumulative…
Microsoft Exchange Server Remote Code Execution Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
A vulnerability in Microsoft Exchange Server allows an attacker with valid credentials to execute arbitrary code remotely on the server. This is critical because Exchange handles sensitive email data, and compromising it can lead to complete system takeover.
CWE-502 (Deserialization of Untrusted Data) allows authenticated attackers to bypass security restrictions and achieve remote code execution through specially crafted requests to vulnerable Exchange services. The attack requires valid user credentials and targets the deserialization process, resulting in arbitrary code execution with Exchange service privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.