Microsoft · Exchange Server
CVE-2022-41040
Microsoft Exchange Server Elevation of Privilege Vulnerability
Exploited in attacks
Used by ransomware
High 8.8 Attack chance: >99.9%
What it is
Microsoft Exchange Server Elevation of Privilege Vulnerability
CISA: Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: October 21, 2022
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 13, 2026 | Deserialization of Untrusted Data | Exchange Server | High 8.8 | 59% |
| Aug 21, 2024 | Information Disclosure | Exchange Server | High 7.2 | 54% |
| Feb 15, 2024 | Privilege Escalation | Exchange Server | Critical 9.8 | 13% |
| Jan 10, 2023 | Privilege Escalation | Exchange Server | High 8.8 | 77% |
| Sep 30, 2022 | Remote Code Execution | Exchange Server | High 8.0 | >99.9% |
| Mar 3, 2022 | Privilege Escalation | Exchange Server | High 7.4 | 27% |
| Jan 18, 2022 | Information Disclosure | Exchange Server | High 7.3 | 98% |
| Nov 3, 2021 | Validation Key Remote Code Execution | Exchange Server | High 8.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.