CVE Watch—

CVE-2022-41040

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

CVSS

—

Sem CVSS

EPSS

100.0%

p100

KEV

SIM

30 de set. de 2022

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

100.0%EPSS · 30 dias100.0%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Microsoft / Exchange Server

Vulnerabilidade

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

Adicionado ao KEV

30 de set. de 2022

Corrigir até

21 de out. de 2022

Uso conhecido em ransomware

Sim

Descrição resumida

Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.

Ação necessária

Apply updates per vendor instructions.

Notas

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; https://nvd.nist.gov/vuln/detail/CVE-2022-41040

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2023-215298.8 ALT

99.1%

KEV—80Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability78d CVE-2022-410808.8 ALT

99.6%

KEV—80Microsoft Exchange Server Privilege Escalation Vulnerability87d CVE-2021-345239.0 CRÍ

100.0%

KEV—80Microsoft Exchange Server Privilege Escalation Vulnerability87d CVE-2021-344739.1 CRÍ

100.0%

KEV—80Microsoft Exchange Server Remote Code Execution Vulnerability87d CVE-2021-337667.3 ALT

99.9%

KEV—80Microsoft Exchange Server Information Disclosure87d CVE-2021-311967.2 ALT

99.0%

KEV—80Microsoft Exchange Server Information Disclosure Vulnerability87d