⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-03-17.

CVE-2018-8581

6 documents6 sources
Severity
7.4HIGH
EPSS
91.5%
top 0.33%
CISA KEV
KEVRansomware
Added 2022-03-03
Due 2022-03-17
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Microsoft Microsoft Exchange ServerMicrosoft Exchange Server
Timeline
PublishedNov 14
KEV addedMar 3
KEV dueMar 17
Latest updateMay 13
CISA Required Action: Apply updates per vendor instructions.

Description

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages2 packages

▶NVDmicrosoft/exchange_server4 versions+3
▶CVEListV5microsoft/microsoft_exchange_server4 versions+3

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-h9jh-6fmr-vvc6: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability↗2022-05-13
▶
CVEList
CVE-2018-8581: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability↗2018-11-14
▶
VulnCheck
Microsoft Exchange Server Privilege Escalation Vulnerability↗2018
▶

📋Vendor Advisories

2
CISA
Microsoft Exchange Server Privilege Escalation Vulnerability↗2022-03-03
▶
Microsoft
Microsoft Exchange Server Elevation of Privilege Vulnerability↗2018-11-13
▶