CVE-2022-41082
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange ServerApplications & CMS
CVSS
8.0HighExploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply updates per vendor instructions. CISA KEV
What fixes it
- 15.00.1497.044Microsoft Exchange Server 2013 Cumulative Update 23CVE List
- 15.01.2375.037Microsoft Exchange Server 2016 Cumulative Update 22CVE List
- 15.02.0986.036Microsoft Exchange Server 2019 Cumulative Update 11CVE List
- 15.02.1118.020Microsoft Exchange Server 2019 Cumulative Update 12CVE List
- 15.01.2507.016Microsoft Exchange Server 2016 Cumulative Update 23CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 28 Sep 2022Exploit code publicMetasploit
- 30 Sep 2022Added to CISA KEVCISA KEV
- 3 Oct 2022, 00:00 UTCPublishedCVE List
Public exploit code and templates 1
- Exploit moduleMicrosoft Exchange ProxyNotShell RCE 28 Sep 2022Metasploit
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Description
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Text from CVE List
Affected versions 5
- Microsoft Exchange Server 2013 Cumulative Update 23affected: 15.00.0 before 15.00.1497.044CVE List
- Microsoft Exchange Server 2016 Cumulative Update 22affected: 15.0.0 before 15.01.2375.037CVE List
- Microsoft Exchange Server 2019 Cumulative Update 11affected: 15.02.0 before 15.02.0986.036CVE List
- Microsoft Exchange Server 2019 Cumulative Update 12affected: 15.02.0 before 15.02.1118.020CVE List
- Microsoft Exchange Server 2016 Cumulative Update 23affected: 15.01.0 before 15.01.2507.016CVE List
References 9
- msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082Advisoryvia CVE List
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082Advisoryvia CVE List
- kb.cert.org/vuls/id/915563Advisoryvia CVE List
- msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/Referencevia CISA KEV
- nvd.nist.gov/vuln/detail/CVE-2022-41082Referencevia CISA KEV
- vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-scriptReferencevia CVE List
- vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-scriptReferencevia CVE List
- secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/Referencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082Referencevia CVE List