CVE-2022-41040
published 2022-10-03CVE-2022-41040: Microsoft Exchange Server Elevation of Privilege Vulnerability
PriorityP197high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-10-21
Exploited in the wild
EPSS
99.96%
100.0th percentile
Microsoft Exchange Server Elevation of Privilege Vulnerability
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | microsoft_exchange_server_2013_cumulative_update_23 | >= 15.00.0 < 15.00.1497.044 | 15.00.1497.044 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_22 | >= 15.0.0 < 15.01.2375.037 | 15.01.2375.037 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_23 | >= 15.01.0 < 15.01.2507.016 | 15.01.2507.016 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_11 | >= 15.02.0 < 15.02.0986.036 | 15.02.0986.036 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_12 | >= 15.02.0 < 15.02.1118.020 | 15.02.1118.020 |
| msrc | microsoft_exchange_server_2013_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_22 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_11 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_12 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandGet-ChildItem -Recurse -Path -Filter "*.log" | Select-String -Pattern 'powershell.*autodiscover\.json.*\@.*200'↗
- →Search IIS logs for autodiscover.json requests chained with PowerShell returning HTTP 200, indicative of CVE-2022-41040 SSRF exploitation attempts. ↗
- →Detect China Chopper webshell activity by monitoring for w3wp.exe spawning processes with command lines containing &ipconfig&echo, &whoami&echo, &echo [E], or &echo [S]. ↗
- →Detect suspicious file writes (EXE/DLL) to C:\Users\Public\ on Exchange hosts where w3wp.exe is present, indicating post-exploitation staging. ↗
- →Detect suspicious file creation in Exchange FrontEnd\HttpProxy directories by w3wp.exe processes with MSExchange in the command line. ↗
- →Detect certutil making outbound connections to public IPs on port 8080, which may indicate post-exploitation connectivity checks in Exchange 0-day attacks. ↗
- →The OWASSRF exploit method targets the OWA endpoint directly (POST to /owa/{email}/powershell) rather than autodiscover, bypassing the URL rewrite mitigation pattern (?=.*autodiscover)(?=.*powershell). ↗
- →Monitor Exchange Remote PowerShell logs at C:\Program Files\Microsoft\Exchange Server\V15\Logging\CmdletInfra\Powershell-Proxy\Http\ for signs of exploitation. ↗
- →Track attacker IPs associated with ProxyNotShell exploitation; 137.184.67.33 was identified as a C2 server in GTSC's investigation. ↗
- →Monitor for PowerShell spawned as a child of IIS (w3wp.exe) as an indicator of CVE-2022-41082 RCE execution. ↗
- ·The URL rewrite mitigation pattern (?=.*autodiscover)(?=.*powershell) is NOT effective against the OWASSRF exploit method, which routes requests directly through the OWA endpoint instead of autodiscover. ↗
- ·Exploitation requires authenticated access with at minimum standard user credentials; Exchange Online customers are not affected. ↗
- ·CVE-2022-41040 affects only on-premises Exchange Server 2013, 2016, and 2019; Exchange Online is not affected. ↗
- ·Ensure X-Forwarded-For header is configured to log true external IP addresses for requests to proxied services, otherwise attacker IPs may not be visible in logs. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6ph7-8wxv-6gf2: Microsoft Exchange Server Elevation of Privilege Vulnerability
ghsa_unreviewed·2022-10-04
CVE-2022-41040 [HIGH] CWE-269 GHSA-6ph7-8wxv-6gf2: Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability.
VulnCheck
Microsoft Exchange Server Remote Code Execution Vulnerability
vulncheck·2022·CVSS 8.8
CVE-2022-41082 [HIGH] CWE-502 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Affected: Microsoft Exchange Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html; https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Sep; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUr
VulnCheck
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
vulncheck·2022·CVSS 8.8
CVE-2022-41040 [HIGH] CWE-918 Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
Affected: Microsoft Exchange Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html; https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Sep; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://securelist.com/cve-20
CISA
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
cisa·2022-09-30·CVSS 8.8
CVE-2022-41040 [HIGH] CWE-918 Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Vulnerability: Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Affected: Microsoft Exchange Server
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; https://nvd.nist.gov/vuln/detail/CVE-2022-41040
Remediation Due Date: 2022-10-21
CISA
Microsoft Exchange Server Remote Code Execution Vulnerability
cisa·2022-09-30·CVSS 8.8
CVE-2022-41082 [HIGH] CWE-502 Microsoft Exchange Server Remote Code Execution Vulnerability
Vulnerability: Microsoft Exchange Server Remote Code Execution Vulnerability
Affected: Microsoft Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; https://nvd.nist.gov/vuln/detail/CVE-2022-41082
Remediation Due Date: 2022-10-21
Microsoft
Microsoft Exchange Server Elevation of Privilege Vulnerability
vendor_msrc·2022-09-13·CVSS 8.8
CVE-2022-41040 [HIGH] Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
FAQ: According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?
Yes, the attacker must be authenticated.
FAQ: Do I need to take further steps to be protected from this vulnerability?
Microsoft Exchange Online customers do not need to take any action.
Exchange Server customers should review and apply the mitigation instructions described in Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server.
FAQ: What privileges can an attacker gain by exploiting this vulnerability?
The privileges acquired by the attacker would be the ability to run PowerShell in the context of the system.
FAQ: Where can I find more informati
Suricata
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)
suricata·2022-12-23·CVSS 8.8
CVE-2022-41040 [HIGH] ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/owa/"; startswith; nocase; content:"@"; distance:0; content:"/powershell"; endswith; nocase; fast_pattern; http.user_agent; content:!"ClientInfo"; content:!"Microsoft WinRM Client"; content:!"Exchange BackEnd Probes"; http.request_body; content:"|3c|s|3a|Envelope|20|xmlns|3a|rsp|3d 22|"; startswith; content:"wbem/wsman/1/windows/shell|22|"; within:100; content:"|3c|wsa|3a|To|3e|"; distance:0; content:"|3c|s|3a|Body|3e 3c|rsp|3a|Shel
Suricata
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)
suricata·2022-09-30·CVSS 8.8
CVE-2022-41040 [HIGH] ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"autodiscover.json"; nocase; fast_pattern; content:"Powershell"; nocase; distance:0; reference:url,msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; classtype:attempted-admin; sid:2039065; rev:2; metadata:affected_product Microsoft_Exchange, attack_target Server, created_at 2022_09_30, cve CVE_2022_41040, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_i
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Tenable
Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)
blogs_tenable·2024-02-13·CVSS 7.6
[HIGH] Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
blogs_unit42·2023-06-28·CVSS 9.1
CVE-2021-26855 [CRITICAL] Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
Threat Research Center
High Profile Threats
Malware
## Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
Daniel Frank
Published: June 28, 2023
High Profile Threats
Malware
Cryptocurrency
Cryptojacking
CVE-2021-26855
CVE-2021-33766
CVE-2021-34473
CVE-2022-41040
Manic Menagerie
Microsoft Exchange Server
Persistence method
ProxyNotShell
Webshell
## Executive Summary
Unit 42 researchers discovered an active campaign that targeted several web hosting and IT providers in the United States and European Union from late 2020 to late 2022. Unit 42 tracks the activity associated with this campaign as CL-CRI-0021 and believes it stems from the same threat actor responsible for the previous campaign known as Manic Menagerie .
The threat actor deployed coin m
Unit42
Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
blogs_unit42·2023-06-28
Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor
## Executive Summary
Unit 42 researchers discovered an active campaign that targeted several web hosting and IT providers in the United States and European Union from late 2020 to late 2022. Unit 42 tracks the activity associated with this campaign as CL-CRI-0021 and believes it stems from the same threat actor responsible for the previous campaign known as Manic Menagerie.
The threat actor deployed coin miners on hijacked machines to abuse the compromised servers’ resources. They have further deepened their foothold in victims’ environments by mass deployment of web shells, which granted them sustained access, as well as access to internal resources of the compromised websites.
In doing so, the attackers could potentially have turned the hijacked legitimate websites – hosted by the tar
Tenable
ProxyNotShell, OWASSRF, TabShell: Patch Your Microsoft Exchange Servers Now
blogs_tenable·2023-01-31
ProxyNotShell, OWASSRF, TabShell: Patch Your Microsoft Exchange Servers Now
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Threat Brief: OWASSRF Vulnerability Exploitation
blogs_unit42·2022-12-23·CVSS 8.8
CVE-2022-41080 [HIGH] Threat Brief: OWASSRF Vulnerability Exploitation
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: OWASSRF Vulnerability Exploitation
Robert Falcone
Lior Rochberger
Published: December 22, 2022
High Profile Threats
Vulnerabilities
Backdoor
CVE-2022-41080
CVE-2022-41082
Microsoft Exchange Server
OWASSRF
ProxyNotShell
SilverArrow
## Executive Summary
On Dec. 20, 2022, CrowdStrike published a blog discussing a new exploit method for Microsoft Exchange Server, which they named OWASSRF, referring to server-side request forgery in relation to Outlook on the web. (Outlook on the web is known as both Outlook Web Access and Outlook Web Application.)
The OWASSRF exploit method involves two different vulnerabilities tracked by CVE-2022-41080 and CVE-2022-41082 that allow remote code execution (RCE) v
Unit42
Threat Brief: OWASSRF Vulnerability Exploitation
blogs_unit42·2022-12-23·CVSS 8.8
CVE-2022-41080 [HIGH] Threat Brief: OWASSRF Vulnerability Exploitation
## Executive Summary
On Dec. 20, 2022, CrowdStrike published a blog discussing a new exploit method for Microsoft Exchange Server, which they named OWASSRF, referring to server-side request forgery in relation to Outlook on the web. (Outlook on the web is known as both Outlook Web Access and Outlook Web Application.)
The OWASSRF exploit method involves two different vulnerabilities tracked by CVE-2022-41080 and CVE-2022-41082 that allow remote code execution (RCE) via Outlook Web Access (OWA). The CVE-2022-41082 vulnerability was previously used by the ProxyNotShell exploit. However, the OWASSRF exploit method bypasses mitigations previously provided by Microsoft for ProxyNotShell. OWASSRF requires authentication to the Exchange Server prior to exploitation, thus we are seeing isolated r
Wiz
OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog
blogs_wiz·2022-12-22·CVSS 8.8
CVE-2022-41080 [HIGH] OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog
A new exploit method, referred to as OWASSRF, has been discovered by researchers and exploited in the wild. This exploit combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution (RCE) through Outlook Web Access (OWA). The OWASSRF exploit successfully bypasses URL rewrite mitigations previously provided by Microsoft for ProxyNotShell.
## What is OWASSRF?
On September 29, 2022, reports emerged of active exploitation of two zero-day vulnerabilities in Microsoft Exchange, which could allow remote code execution (RCE). These vulnerabilities were identified by Microsoft as CVE-2022-41040, a server-side request forgery (SSRF) vulnerability, and CVE-2022-41082, which allows RCE. These vulnerabilities were collectively referred to as ProxyNotShell.
On December 20th, researchers
Wiz
OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog
blogs_wiz·2022-12-22·CVSS 8.8
CVE-2022-41080 [HIGH] OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog
A new exploit method, referred to as OWASSRF, has been discovered by researchers and exploited in the wild. This exploit combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution (RCE) through Outlook Web Access (OWA). The OWASSRF exploit successfully bypasses URL rewrite mitigations previously provided by Microsoft for ProxyNotShell.
# What is OWASSRF?
On September 29, 2022, reports emerged of active exploitation of two zero-day vulnerabilities in Microsoft Exchange, which could allow remote code execution (RCE). These vulnerabilities were identified by Microsoft as CVE-2022-41040, a server-side request forgery (SSRF) vulnerability, and CVE-2022-41082, which allows RCE. These vulnerabilities were collectively referred to as ProxyNotShell.
On December 20th, researchers
Securelist
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
blogs_securelist·2022-12-19·CVSS 6.6
CVE-2022-41040 [MEDIUM] CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
Table of Contents
- Summary
- ProxyNotShell exploitation details
- ProxyNotShell post exploitation
- Our recommendations
- Indicators of compromise
Authors
- Vitaly Morgunov
- Dmitry Kondratyev
- Alexander Kolesnikov
- Alexey Kulaev
## Summary
At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the investigation, experts found that two 0-day vulnerabilities in Microsoft Exchange Server were used in the attack. The first one, later identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to remotely trigger the next vulnerability – CVE-2022-41082. The second vulnerability, in turn, allows remote code execution (RCE) when MS Exchange PowerShell is accessible to the
Securelist
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
blogs_securelist·2022-12-19·CVSS 6.6
[MEDIUM] CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
Table of Contents
Summary
ProxyNotShell exploitation details
ProxyNotShell post exploitation
Our recommendations
Indicators of compromise
Authors
Vitaly Morgunov
Dmitry Kondratyev
Alexander Kolesnikov
Alexey Kulaev
## Summary
At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the investigation, experts found that two 0-day vulnerabilities in Microsoft Exchange Server were used in the attack. The first one, later identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to remotely trigger the next vulnerability – CVE-2022-41082. The second vulnerability, in turn, allows remote code execution (RCE) when MS Exchange PowerShell is accessible to the attacker. A
Securelist
IT threat evolution in Q3 2022. Non-mobile statistics
blogs_securelist·2022-11-18
IT threat evolution in Q3 2022. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Number of users attacked by banking malware
TOP 10 banking malware families
Geography of financial malware attacks
Ransomware programs
Quarterly trends and highlights
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
Vulnerability statistics
Attacks on macOS
TOP 20 threats for macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries and territories that serve as sources of web-ba
Securelist
PC malware statistics, Q3 2022
blogs_securelist·2022-11-18
PC malware statistics, Q3 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q3 2022
- IT threat evolution in Q3 2022. Non-mobile statistics
- IT threat evolution in Q3 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2022:
- Kaspersky solutions blocked 956,074,958 attacks from online resources across the globe.
- Web Anti-Virus recognized 251,288,987 unique URLs as malicious.
- Attempts to run malware fo
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
## Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative Nov 16, 2022 Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
# Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative
2022/11/16
Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it ca
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
## Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative 2022/11/16 Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it ca
Krebs
Patch Tuesday, November 2022 Election Edition
blogs_krebs·2022-11-09·CVSS 7.8
[HIGH] Patch Tuesday, November 2022 Election Edition
Let’s face it: Having “2022 election” in the headline above is probably the only reason anyone might read this story today. Still, while most of us here in the United States are anxiously awaiting the results of how well we’ve patched our Democracy, it seems fitting that Microsoft Corp. today released gobs of security patches for its ubiquitous Windows operating systems. November’s patch batch includes fixes for a whopping six zero-day security vulnerabilities that miscreants and malware are already exploiting in the wild.
Probably the scariest of the zero-day flaws is CVE-2022-41128 , a “critical” weakness in the Windows scripting languages that could be used to foist malicious software on vulnerable users who do nothing more than browse to a hacked or malicious site that exploits the we
Krebs
Patch Tuesday, November 2022 Election Edition
blogs_krebs·2022-11-09·CVSS 7.8
[HIGH] Patch Tuesday, November 2022 Election Edition
Let’s face it: Having “2022 election” in the headline above is probably the only reason anyone might read this story today. Still, while most of us here in the United States are anxiously awaiting the results of how well we’ve patched our Democracy, it seems fitting that Microsoft Corp. today released gobs of security patches for its ubiquitous Windows operating systems. November’s patch batch includes fixes for a whopping six zero-day security vulnerabilities that miscreants and malware are already exploiting in the wild.
Probably the scariest of the zero-day flaws is CVE-2022-41128, a “critical” weakness in the Windows scripting languages that could be used to foist malicious software on vulnerable users who do nothing more than browse to a hacked or malicious site that exploits the wea
Qualys
November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).
blogs_qualys·2022-11-08·CVSS 7.5
[HIGH] November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).
## Table of Contents
Microsoft Patch Tuesday Summary
The November 2022 Microsoft Vulnerabilities are Classified as Follows:
OpenSSL 3.x Critical Vulnerability Highlights
OpenSSL 3.x Related Blogs and Resources
Microsoft Addressed Six Zero-Day Vulnerabilities
Microsoft Patch Tuesday Critical Vulnerability Highlights
Microsoft Release Summary
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Research Blog Posts
Qualys Threat Protection High-Rated Advisories
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
Rapid Response with Patch Management (PM)
Extend the Power of VMDR to Enterprise Mobile Devices With Qualys VMDR Mobile
Execute Mitigation UsingCustom Assessment and Remediation(CAR)
Patch Tuesday Is
Tenable
Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)
blogs_tenable·2022-11-08·CVSS 7.8
[HIGH] Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years). | Qualys
blogs_qualys·2022-11-08·CVSS 7.5
[HIGH] November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years). | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The November 2022 Microsoft Vulnerabilities are Classified as Follows:
- OpenSSL 3.x Critical Vulnerability Highlights
- OpenSSL 3.x Related Blogs and Resources
- Microsoft Addressed Six Zero-Day Vulnerabilities
- Microsoft Patch Tuesday Critical Vulnerability Highlights
- Microsoft Release Summary
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Research Blog Posts
- Qualys Threat Protection High-Rated Advisories
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
- Rapid Response with Patch Management (PM)
- Extend the Power of VMDR to Enterprise Mobile Devices With Qualys VMDR Mobile
- Execute Mitigation UsingCustom Assessment and Remediation(CAR)
Qualys
Qualys Research Team: Threat Thursdays, October 2022
blogs_qualys·2022-10-28
Qualys Research Team: Threat Thursdays, October 2022
## Table of Contents
From the Qualys Blog
New Tools & Techniques
New Vulnerabilities
Noteworthy Mentions
Threat Thursdays Webinar
Welcome to the third edition of the Qualys Research Team’s “Threat Research Thursday”, where we collect and curate notable new tools, techniques, procedures, threat intelligence, cybersecurity news, malware attacks, and more. Feedback on our second edition, Qualys Threat Research Thursday , is more than welcome. We would love to hear from you!
## From the Qualys Blog
Here is a roundup of the most interesting blogs from the Qualys Research Team over the past couple of weeks:
Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform – How do you detect the ProxyNotShell vulnerability that was released a month a
Qualys
Qualys Research Team: Threat Thursdays, October 2022 | Qualys
blogs_qualys·2022-10-28·CVSS 7.8
[HIGH] Qualys Research Team: Threat Thursdays, October 2022 | Qualys
#### Table of Contents
- From the Qualys Blog
- New Tools & Techniques
- New Vulnerabilities
- Noteworthy Mentions
- Threat Thursdays Webinar
Welcome to the third edition of the Qualys Research Team’s “Threat Research Thursday”, where we collect and curate notable new tools, techniques, procedures, threat intelligence, cybersecurity news, malware attacks, and more. Feedback on our second edition, Qualys Threat Research Thursday, is more than welcome. We would love to hear from you!
## From the Qualys Blog
Here is a roundup of the most interesting blogs from the Qualys Research Team over the past couple of weeks:
- Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform – How do you detect the ProxyNotShell vulnerability that was released
Qualys
October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical. | Qualys
blogs_qualys·2022-10-11·CVSS 7.8
[HIGH] October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical. | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- Microsoft Exchange ProxyNotShell Zero-Days Not Yet Addressed (QID 50122)
- The October 2022 Microsoft Vulnerabilities Are Classified As Follows:
- Two Zero-Day Vulnerabilities Addressed
- Microsoft Critical Vulnerability Highlights
- Microsoft Release Summary
- Microsoft Edge | Last But Not Least
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Research Blog Posts
- Qualys Threat Protection High-Rated Advisories
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
- Rapid Response With Patch Management (PM)
- EXECUTE Mitigation Using Custom Assessment and Remediation (CAR)
- EVALUATE Vendor-Suggested Mitigation With Policy Compliance (PC)
- This Month
Qualys
October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical.
blogs_qualys·2022-10-11·CVSS 7.8
[HIGH] October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
Microsoft Exchange ProxyNotShell Zero-Days Not Yet Addressed (QID 50122)
The October 2022 Microsoft Vulnerabilities Are Classified As Follows:
Two Zero-Day Vulnerabilities Addressed
Microsoft Critical Vulnerability Highlights
Microsoft Release Summary
Microsoft Edge | Last But Not Least
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Research Blog Posts
Qualys Threat Protection High-Rated Advisories
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
Rapid Response With Patch Management (PM)
EXECUTE Mitigation Using Custom Assessment and Remediation (CAR)
EVALUATE Vendor-Suggested Mitigation With Policy Compliance (PC)
This Month in Vulnerabilities
Tenable
Microsoft’s October 2022 Patch Tuesday Addresses 84 CVEs (CVE-2022-41033)
blogs_tenable·2022-10-11·CVSS 7.8
[HIGH] Microsoft’s October 2022 Patch Tuesday Addresses 84 CVEs (CVE-2022-41033)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Zscaler
Coverage Advisory For MS Exchange Server Vulnerabilities
blogs_zscaler·2022-10-07·CVSS 8.8
[HIGH] Coverage Advisory For MS Exchange Server Vulnerabilities
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Talos
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
blogs_talos·2022-10-06
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
As I wrote about last week, I’ve been diving a lot into apps’ privacy policies recently. And I was recently made aware of a new type of app I never knew existed — family trackers.
There are countless mobile apps for parents to track their children or other family members based on their location, phone usage, and even driving speed. As an anxious soon-to-be-parent, this sounds intriguing to me — it’d be a supped-up version of Find my Friends on Apple devices so I’d never have to ask my teenager (granted, I’m many years away from being at that stage of my life) when they were coming home or where they were.
Just as with all other types of mobile apps, there are pitfalls, though.
Life360, one of the most popular of these types of apps and even tells users what their maximum driving speed w
Talos
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
blogs_talos·2022-10-06
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
## Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
As I wrote about last week , I’ve been diving a lot into apps’ privacy policies recently . And I was recently made aware of a new type of app I never knew existed — family trackers.
There are countless mobile apps for parents to track their children or other family members based on their location, phone usage, and even driving speed. As an anxious soon-to-be-parent, this sounds intriguing to me — it’d be a supped-up version of Find my Friends on Apple devices so I’d never have to ask my teenager (granted, I’m many years away from being at that stage of my life) when they were coming home or where they were.
Just as with all other types of mobile apps, there are pitfalls, though.
Life360, one of
Unit42
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
blogs_unit42·2022-10-04·CVSS 6.6
CVE-2022-41040 [MEDIUM] Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
## Executive Summary
In early August, GTSC discovered a new Microsoft Exchange zero-day remote code execution (RCE) that was very similar to ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207).
The exploit was discovered in the wild in what appeared to be a SOC investigation into suspicious activity of one of GTSC’s customers. Once they determined the scope of the vulnerabilities, GTSC reported the vulnerability to the Zero-day Initiative (ZDI) to enable further coordination with Microsoft. The vulnerabilities were assigned CVE-2022-41040 and CVE-2022-41082 and rated with severities of critical and important respectively. The first one, identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability, while the second one, identified as CVE-2022-41082, allow
Unit42
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
blogs_unit42·2022-10-04·CVSS 6.6
CVE-2022-41040 [MEDIUM] Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
Shawn Westfall
Published: October 4, 2022
High Profile Threats
Vulnerabilities
CVE-2022-41040
CVE-2022-41082
Exploit in the wild
Microsoft Exchange Server
ProxyNotShell
Threat intelligence
## Executive Summary
In early August, GTSC discovered a new Microsoft Exchange zero-day remote code execution (RCE) that was very similar to ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207).
The exploit was discovered in the wild in what appeared to be a SOC investigation into suspicious activity of one of GTSC’s customers. Once they determined the scope of the vulnerabilities, GTSC reported the vulnerability to the Zer
Checkpoint
3rd October – Threat Intelligence Report
blogs_checkpoint·2022-10-03
CVE-2022-41040 3rd October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd October, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research identified an ongoing, mobile malware campaign that has consistently targeted Uyghurs for at least the past seven years. Attributed to the actor Scarlet Mimic, the malware campaign was disguised in multiple baits such as books, pictures, and even an audio version of the Quran.
Check Point Harmony Mobil
Qualys
Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform
blogs_qualys·2022-09-30·CVSS 8.8
[HIGH] Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform
## Table of Contents
Qualys Vulnerability Coverage (QID)
Detect ProxyNotShell Using Qualys VMDR
Microsoft Guidance for Risk Mitigation of ProxyNotShell
Detect Malicious Behavior related to ProxyNotShell using Qualys Multi-Vector EDR
Indicators of Compromise (IOCs) for ProxyNotShell
Contributors
On September 29, 2022, active attacks against Microsoft Exchange were reported by Vietnamese cybersecurity company GTSC. The researcher at GTSC reported two critical vulnerabilities (now named “ProxyNotShell”) in Microsoft Exchange Server via two advisories issued by Zero Day Initiative : ZDI-CAN-18333 and ZDI-CAN-18802 .
The first flaw (CVE-2022-41040) is a Server-Side Request Forgery (SSRF) vulnerability. The second flaw (CVE-2022-41082) allows remote code execution (RCE) when PowerShell i
Tenable
CVE-2022-41040 and CVE-2022-41082: ProxyShell Variant Exploited in the Wild
blogs_tenable·2022-09-30·CVSS 8.8
[HIGH] CVE-2022-41040 and CVE-2022-41082: ProxyShell Variant Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
blogs_talos·2022-09-30·CVSS 8.8
[HIGH] Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
## Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
Cisco Talos has released new coverage to detect and prevent the exploitation of two recently disclosed vulnerabilities collectively referred to as "ProxyNotShell," affecting Microsoft Exchange Servers 2013, 2016 and 2019. One of these vulnerabilities could allow an attacker to execute remote code on the targeted server. Limited exploitation of these vulnerabilities in the wild has been reported. CVE-2022-41040 is a Server Side Request Forgery (SSRF) vulnerability, while CVE-2022-41082 enables Remote Code Execution (RCE) when PowerShell is accessible to the attackers. While no fixes or patches are available yet, Microsoft has provided mitigations for on-premises Microsoft Exchange users on Sept. 29
Qualys
Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform | Qualys
blogs_qualys·2022-09-30·CVSS 8.8
[HIGH] Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform | Qualys
#### Table of Contents
- Qualys Vulnerability Coverage (QID)
- Detect ProxyNotShell Using Qualys VMDR
- Microsoft Guidance for Risk Mitigation of ProxyNotShell
- Detect Malicious Behavior related to ProxyNotShell using Qualys Multi-Vector EDR
- Indicators of Compromise (IOCs) for ProxyNotShell
- Contributors
On September 29, 2022, active attacks against Microsoft Exchange were reported by Vietnamese cybersecurity company GTSC. The researcher at GTSC reported two critical vulnerabilities (now named “ProxyNotShell”) in Microsoft Exchange Server via two advisories issued by Zero Day Initiative: ZDI-CAN-18333 and ZDI-CAN-18802.
The first flaw (CVE-2022-41040) is a Server-Side Request Forgery (SSRF) vulnerability. The second flaw (CVE-2022-41082) allows remote code execution (RCE) when Power
Krebs
Microsoft: Two New 0-Day Flaws in Exchange Server
blogs_krebs·2022-09-30·CVSS 8.8
[HIGH] Microsoft: Two New 0-Day Flaws in Exchange Server
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.
In customer guidance released Thursday, Microsoft said it is investigating two reported zero-day flaws affecting Microsoft Exchange Server 2013, 2016, and 2019. CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability that can enable an authenticated attacker to remotely trigger the second zero-day vulnerability — CVE-2022-41082 — which allows remote code execution (RCE) when Po
Fortinet
Microsoft Exchange 0-Day Vulnerability Updates | FortiGuard Labs
blogs_fortinet·2022-09-30·CVSS 6.6
CVE-2022-41040 [MEDIUM] Microsoft Exchange 0-Day Vulnerability Updates | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Microsoft Exchange 0-Day Vulnerability Updates
By James Slaughter | September 30, 2022
On 28th September, 2022, the cybersecurity company GTSC released a blog detailing an exploit attempt on a system they were monitoring. After analysis, they were able to locate and submit two bugs to Microsoft via the Zero Day Initiative (ZDI-CAN-18333 (CVSS 8.8) and ZDI-CAN-18802 (CVSS 6.3)). Microsoft validated the findings and CVE-2022-41040 and CVE-2022-41082 were assigned to the vulnerabilities.
CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability and CVE-2022-41082 allows for remote code execution (RCE) where PowerShell is available.
This blog describes what you need to know about these vulnerabilities.
Affected Platforms: On premises Microsoft Ex
Talos
Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
blogs_talos·2022-09-30·CVSS 8.8
CVE-2022-41040 [HIGH] Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
Cisco Talos has released new coverage to detect and prevent the exploitation of two recently disclosed vulnerabilities collectively referred to as "ProxyNotShell," affecting Microsoft Exchange Servers 2013, 2016 and 2019. One of these vulnerabilities could allow an attacker to execute remote code on the targeted server. Limited exploitation of these vulnerabilities in the wild has been reported. CVE-2022-41040 is a Server Side Request Forgery (SSRF) vulnerability, while CVE-2022-41082 enables Remote Code Execution (RCE) when PowerShell is accessible to the attackers.
While no fixes or patches are available yet, Microsoft has provided mitigations for on-premises Microsoft Exchange users on Sept. 29, 2022. Even organizations that use Exchange Online may still be affected if they run a hybri
Krebs
Microsoft: Two New 0-Day Flaws in Exchange Server
blogs_krebs·2022-09-30·CVSS 8.8
[HIGH] Microsoft: Two New 0-Day Flaws in Exchange Server
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server , a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.
In customer guidance released Thursday, Microsoft said it is investigating two reported zero-day flaws affecting Microsoft Exchange Server 2013, 2016, and 2019. CVE-2022-41040 , is a Server-Side Request Forgery (SSRF) vulnerability that can enable an authenticated attacker to remotely trigger the second zero-day vulnerability — CVE-2022-41082 — which allows remote code execution (RCE) when
Huntress
New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
blogs_huntress·2022-09-29·CVSS 8.8
[HIGH] New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
Our team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers that could lead to Remote Code Execution (RCE) for an authenticated user.
Our ThreatOps team discovered this blog , and the team began to research and see if anyone else in the community had flagged it. We found this tweet from Security Researcher Kevin Beaumont, where he notes that “significant numbers of Exchange servers have been backdoored - including a honeypot.”
We’ll continue to update this blog with our latest findings and research.
## Updates
Update 1 (9/29/22 @ 8:18pm ET) : Clarified GTSC updated language to affirm this is a new vulnerability and 0-day.
Update 2 (9/30/22 @ 9:23am ET) : Included Microsoft official details and CVE identifiers.
## What You Need to Know
As of 9/29/22 @ 8
Crowdstrike
OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Crowdstrike
Patch Tuesday Turns 20: The Impact of Microsoft’s Vulnerability Problem
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Patch Tuesday Turns 20: The Impact of Microsoft’s Vulnerability Problem
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Greynoiseio
GreyNoise
blogs_greynoiseio·CVSS 8.8
[HIGH] GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
blogs_zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
## CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day
Deepen Desai
Contributor
Zscaler
## Nov 2, 2022
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research and relevant insights on cyber-related subjects from the ThreatLabz team and Deepen Desai, CISO at Zscaler.
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research from Deepen Desai and the ThreatLabz team, along with insights on other cyber-related subjects. In October, ThreatLabz released their 2022 Data Loss Report, researched a PHP version of Ducktail infostealer, and analyzed LilithBot malware. My team a
Crowdstrike
October Patch Tuesday 2022: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] October Patch Tuesday 2022: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Threat Intel
Play (Play)
threat_intel·CVSS 9.1
[CRITICAL] Play (Play)
# Threat Actor Profile: Play
ATT&CK ID: G1040
Also known as: Play
## Overview
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
## Techniques (TTPs)
### Resource Development
- T1587.001 Malware
Usage: Play developed and employ Playcrypt ransomware.(Citation: Trend Micro Ransomware Spotlight Play July 2023)(Citation: CISA Play Ransomware A
Crowdstrike
Patch Tuesday Turns 20: The Impact of Microsoft’s Vulnerability Problem
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] Patch Tuesday Turns 20: The Impact of Microsoft’s Vulnerability Problem
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Threat Intel
Ember Bear (Ember Bear, UNC2589, Bleeding Bear)
threat_intel
Ember Bear (Ember Bear, UNC2589, Bleeding Bear)
# Threat Actor Profile: Ember Bear
ATT&CK ID: G1003
Also known as: Ember Bear, UNC2589, Bleeding Bear, DEV-0586, Cadet Blizzard, Frozenvista, UAC-0056
Suspected origin: Russia
## Overview
Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).(Citation: CISA GRU29155 2024) Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.(Citation: Cadet Blizzard emerges as novel threat actor) Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.(Citation: Crowd
Crowdstrike
October Patch Tuesday 2022: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] October Patch Tuesday 2022: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
November 2022 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] November 2022 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Huntress
New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
blogs_huntress·CVSS 8.8
[HIGH] New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
Our team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers that could lead to Remote Code Execution (RCE) for an authenticated user.
Our ThreatOps team discovered this blog, and the team began to research and see if anyone else in the community had flagged it. We found this tweet from Security Researcher Kevin Beaumont, where he notes that “significant numbers of Exchange servers have been backdoored - including a honeypot.”
We’ll continue to update this blog with our latest findings and research.
## Updates
Update 1 (9/29/22 @ 8:18pm ET): Clarified GTSC updated language to affirm this is a new vulnerability and 0-day.
Update 2 (9/30/22 @ 9:23am ET): Included Microsoft official details and CVE identifiers.
## What You Need to Know
As of 9/29/22 @ 8:18
HackerOne
mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040
hackerone·2022-10-13·CVSS 8.8
CVE-2022-41040 [HIGH] mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040
mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040
Hello Acronis team,
Please run
curl -ksL -m5 -o /dev/null -I -w "%{http_code}" "https://mail.acronis.com/autodiscover/autodiscover.json?Email=autodiscover/[email protected]&Protocol=ActiveSync"
curl -ksL -m5 "https://mail.acronis.com/autodiscover/autodiscover.json?Email=autodiscover/[email protected]&Protocol=ActiveSync" | grep Protocol
and get following output
404 and {"Protocol":"ActiveSync","Url":"https://eas.outlook.com/Microsoft-Server-ActiveSync"}
Proving that mail.acronis.com is vulnerable to CVE-2022-41040
Poc video attached
## Impact
SSRF can be used to for unauthorized actions or access to confidential data.
mail.acronis.com was vulnerable to CVE-2022-41040.
After internal i
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41040https://www.kb.cert.org/vuls/id/915563https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41040
2022-10-03
Published
2022-09-30
Added to CISA KEV
Exploited in the wild