Skip to content
OpenAdvisories
High 1 exploited CVE MSRC-CVE-2022-41082 1 CVE

Microsoft Exchange Server Remote Code Execution Vulnerability

Published Sep 13, 2022 · Updated Nov 8, 2022 · Revision 3

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Exploited according to Microsoft — Exploitation Detected. Customer action: Required.

Details

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is none (UI:N). What is the target used in the context of the remote code execution?
The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server's account through a network call.

According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?
Yes, the attacker must be authenticated.

Where can I find more information about this CVE?
Please see Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server for more information

Security updates
15.00.1497.044 — https://support.microsoft.com/help/5019758

Vulnerabilities 1

Revision history

  1. #3

    On November, 8 2022, Microsoft released updates to address this vulnerability. Customers who are running an affected version of Microsoft Exchange Server should install the updates to be protected.

  2. #2

    Updated FAQ information. This is an informational change only.

  3. #1

    Information published.

References