All vulnerabilities
CVE-2022-41080

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange ServerApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 10 Jan 2023. Known ransomware useCISA KEV
Exploit odds (EPSS)77.3%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in15.00.1497.044Also 15.01.2375.037, 15.01.2507.016 and 2 moreCVE List
Federal deadline31 Jan 2023Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 15.00.1497.044Microsoft Exchange Server 2013 Cumulative Update 23CVE List
  • 15.01.2375.037Microsoft Exchange Server 2016 Cumulative Update 22CVE List
  • 15.01.2507.016Microsoft Exchange Server 2016 Cumulative Update 23CVE List
  • 15.02.0986.036Microsoft Exchange Server 2019 Cumulative Update 11CVE List
  • 15.02.1118.020Microsoft Exchange Server 2019 Cumulative Update 12CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 9 Nov 2022, 00:00 UTCPublishedCVE List
  2. 10 Jan 2023Added to CISA KEVCISA KEV

Description

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.

Text from CVE List

Affected versions 5

  • Microsoft Exchange Server 2013 Cumulative Update 23affected: 15.00.0 before 15.00.1497.044CVE List
  • Microsoft Exchange Server 2016 Cumulative Update 22affected: 15.0.0 before 15.01.2375.037CVE List
  • Microsoft Exchange Server 2016 Cumulative Update 23affected: 15.01.0 before 15.01.2507.016CVE List
  • Microsoft Exchange Server 2019 Cumulative Update 11affected: 15.02.0 before 15.02.0986.036CVE List
  • Microsoft Exchange Server 2019 Cumulative Update 12affected: 15.02.0 before 15.02.1118.020CVE List

References 4