CVE-2022-41082
published 2022-10-03CVE-2022-41082: Microsoft Exchange Server Remote Code Execution Vulnerability
PriorityP194high8CVSS 3.1
AVAACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2022-10-21
Exploited in the wild
EPSS
99.97%
100.0th percentile
Microsoft Exchange Server Remote Code Execution Vulnerability
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | microsoft_exchange_server_2013_cumulative_update_23 | >= 15.00.0 < 15.00.1497.044 | 15.00.1497.044 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_22 | >= 15.0.0 < 15.01.2375.037 | 15.01.2375.037 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_23 | >= 15.01.0 < 15.01.2507.016 | 15.01.2507.016 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_11 | >= 15.02.0 < 15.02.0986.036 | 15.02.0986.036 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_12 | >= 15.02.0 < 15.02.1118.020 | 15.02.1118.020 |
| msrc | microsoft_exchange_server_2013_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_22 | — | — |
| msrc | microsoft_exchange_server_2016_cumulative_update_23 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_11 | — | — |
| msrc | microsoft_exchange_server_2019_cumulative_update_12 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandGet-ChildItem -Recurse -Path -Filter "*.log" | Select-String -Pattern 'powershell.*autodiscover\.json.*\@.*200'↗
sigma↗
filter event_type = ENUM.PROCESS and actor_process_image_name = "w3wp.exe" and (action_process_image_command_line contains "&ipconfig&echo" or action_process_image_command_line contains "&quesr&echo" or action_process_image_command_line contains "&whoami&echo" or action_process_image_command_line contains "&c:&echo" or action_process_image_command_line contains "&cd&echo" or action_process_image_command_line contains "&echo [E]" or action_process_image_command_line contains "&echo [S]")
sigma↗
filter event_type = ENUM.FILE and actor_process_image_name = "w3wp.exe" and action_file_path contains "FrontEnd\HttpProxy" and actor_process_command_line contains "MSExchange"
- →Detect China Chopper webshell activity by monitoring for w3wp.exe spawning processes with command lines containing China Chopper marker strings such as &ipconfig&echo, &whoami&echo, &echo [E], &echo [S] ↗
- →Detect suspicious file writes in Exchange FrontEnd\HttpProxy directories by w3wp.exe processes with MSExchange in the command line ↗
- →Detect post-exploit certutil connections to public IPs on port 8080 — filter out RFC1918 private address space ↗
- →Detect DLL and EXE writes to C:\Users\Public\ on Exchange hosts (where w3wp.exe is present) as a post-exploitation indicator ↗
- →Search IIS logs for exploitation evidence using the PowerShell pattern matching autodiscover.json with powershell and HTTP 200 responses ↗
- →OWASSRF exploit targets the OWA /owa/{email}/powershell endpoint directly, bypassing the autodiscover-based URL rewrite mitigation for ProxyNotShell; requests made through OWA rather than Autodiscover endpoint ↗
- →The existing ProxyNotShell URL rewrite mitigation regex (?=.*autodiscover)(?=.*powershell) does NOT block OWASSRF since OWASSRF uses the OWA endpoint instead of Autodiscover ↗
- →Monitor Exchange Remote PowerShell logs at C:\Program Files\Microsoft\Exchange Server\V15\Logging\CmdletInfra\Powershell-Proxy\Http\ for signs of exploitation ↗
- →Post-exploitation tools observed include Plink, AnyDesk, BITSadmin, Mimikatz, AdFind, and ConnectWise ScreenConnect; monitor for these on Exchange servers ↗
- →Play ransomware group used OWASSRF (CVE-2022-41080 + CVE-2022-41082) for initial access via OWA; monitor for PowerShell spawned by IIS w3wp.exe as execution indicator ↗
- →Track ProxyNotShell scanning activity in GreyNoise using tag 'Exchange ProxyNotShell Vuln Check' or GNQL query: cve:CVE-2022-41040 OR cve:CVE-2022-41082 ↗
- ·The ProxyNotShell URL rewrite mitigation (blocking requests matching autodiscover+powershell) is NOT effective against the OWASSRF exploit method, which routes directly through the OWA endpoint ↗
- ·CVE-2022-41082 exploitation requires authenticated access (standard user credentials sufficient); the authentication bar is low given widespread credential theft ↗
- ·Affected versions are Exchange Server 2013, 2016, and 2019 before KB5019758; Exchange Online customers are already protected and need no action ↗
- ·Ensure X-Forwarded-For header is configured to log true external IP addresses for requests to proxied Exchange services, otherwise attacker IPs may not be visible in logs ↗
CVSS provenance
nvdv3.18.0HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa9.8CRITICAL
vendor_msrc8.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cg2v-9v73-ccwp: Microsoft Exchange Server Remote Code Execution Vulnerability
ghsa_unreviewed·2022-10-04
CVE-2022-41082 [HIGH] CWE-502 GHSA-cg2v-9v73-ccwp: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability.
VulnCheck
Microsoft Exchange Server Remote Code Execution Vulnerability
vulncheck·2022·CVSS 8.8
CVE-2022-41082 [HIGH] CWE-502 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Affected: Microsoft Exchange Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html; https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Sep; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUr
VulnCheck
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
vulncheck·2022·CVSS 8.8
CVE-2022-41040 [HIGH] CWE-918 Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
Affected: Microsoft Exchange Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html; https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Sep; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://securelist.com/cve-20
VulnCheck
Microsoft Exchange Server Privilege Escalation Vulnerability
vulncheck·2022·CVSS 8.8
CVE-2022-41080 [HIGH] Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Affected: Microsoft Exchange Server
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.bleepingcomputer.com/news/security/microsoft-cuba-ransomware-hacking-exchange-servers-via-owassrf-flaw/; https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf; https://www.dragos.com/blog/ran
CISA
Microsoft Exchange Server Privilege Escalation Vulnerability
cisa·2023-01-10·CVSS 9.8
CVE-2022-41080 [CRITICAL] Microsoft Exchange Server Privilege Escalation Vulnerability
Vulnerability: Microsoft Exchange Server Privilege Escalation Vulnerability
Affected: Microsoft Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080; https://nvd.nist.gov/vuln/detail/CVE-2022-41080
Remediation Due Date: 2023-01-31
CISA
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
cisa·2022-09-30·CVSS 8.8
CVE-2022-41040 [HIGH] CWE-918 Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Vulnerability: Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Affected: Microsoft Exchange Server
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; https://nvd.nist.gov/vuln/detail/CVE-2022-41040
Remediation Due Date: 2022-10-21
CISA
Microsoft Exchange Server Remote Code Execution Vulnerability
cisa·2022-09-30·CVSS 8.8
CVE-2022-41082 [HIGH] CWE-502 Microsoft Exchange Server Remote Code Execution Vulnerability
Vulnerability: Microsoft Exchange Server Remote Code Execution Vulnerability
Affected: Microsoft Exchange Server
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; https://nvd.nist.gov/vuln/detail/CVE-2022-41082
Remediation Due Date: 2022-10-21
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability
vendor_msrc·2022-09-13·CVSS 8.0
CVE-2022-41082 [HIGH] Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is none (UI:N). What is the target used in the context of the remote code execution?
The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server's account through a network call.
FAQ: According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?
Yes, the attacker must be authenticated.
FAQ: Where can I find more information about this CVE?
Please see Customer Guidance for Reported Zero-day Vulner
Suricata
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)
suricata·2022-12-23·CVSS 8.8
CVE-2022-41040 [HIGH] ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/owa/"; startswith; nocase; content:"@"; distance:0; content:"/powershell"; endswith; nocase; fast_pattern; http.user_agent; content:!"ClientInfo"; content:!"Microsoft WinRM Client"; content:!"Exchange BackEnd Probes"; http.request_body; content:"|3c|s|3a|Envelope|20|xmlns|3a|rsp|3d 22|"; startswith; content:"wbem/wsman/1/windows/shell|22|"; within:100; content:"|3c|wsa|3a|To|3e|"; distance:0; content:"|3c|s|3a|Body|3e 3c|rsp|3a|Shel
Suricata
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)
suricata·2022-09-30·CVSS 8.8
CVE-2022-41040 [HIGH] ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"autodiscover.json"; nocase; fast_pattern; content:"Powershell"; nocase; distance:0; reference:url,msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/; classtype:attempted-admin; sid:2039065; rev:2; metadata:affected_product Microsoft_Exchange, attack_target Server, created_at 2022_09_30, cve CVE_2022_41040, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_i
Recorded Future
June 2026 CVE Landscape
blogs_recorded_future·2026-07-10·CVSS 9.1
CVE-2026-35616 [CRITICAL] June 2026 CVE Landscape
## June 2026 CVE Landscape
In June 2026, Insikt Group® identified 60 high-impact vulnerabilities that should be prioritized for remediation , 30 of which had a Very Critical Recorded Future Risk Score. This represents a 49% increase from last month. 23 of the 60 vulnerabilities were included in the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 34 were reported by vendors, and three were primarily surfaced through honeypot data.
The 60 vulnerabilities in this report affected products from 36 vendors, with Microsoft accounting for approximately 18% of the vulnerabilities. The remaining exposure was concentrated across a range of enterprise software, security products, network infrastructure, developer tooling, and cloud platform
Hackernews
New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks
blogs_hackernews·2026-06-26·CVSS 9.8
CVE-2021-26855 [CRITICAL] New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks
A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts.
Kaspersky, which is tracking the activity under the moniker StrikeShark , said the campaign has targeted a diplomatic organization in Indonesia, government organizations in Taiwan, software development companies across multiple countries, and entities associated with other sectors located in Hong Kong, Lebanon, Syria, Colombia, North Macedonia, Ne
Securelist
StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader
blogs_securelist·2026-06-24
CVE-2021-26855 StrikeShark: investigating a new campaign delivering Cobalt Strike through SharkLoader
Fareed Radzi
Table of Contents
Introduction
Initial infection
Exploitation of public-facing applications
Dropper-based distribution
SharkLoader installation
SharkLoader DLL – Main implant
“PerfectDLL Hijacking” technique
Decryption and loading of >DscCoreR.mui
DscCoreR.mui and SyncRes.dat DLLs
Decryption and loading of SyncRes.dat
SyncRes.dat decrypted DLL: Multiple API hooks
VEH registration and access violation handling
Thread creation for Cobalt Strike Beacon execution
MinHook DLL, API hooking, and Cobalt Strike beacon
Persistence mechanism
Post-compromise activity
Victimology
Attribution
Conclusion
Indicators of compromise
Authors
Fareed Radzi
## Introduction
During our research of activity affecting a diplomatic organization in Indonesia, we uncovered a previo
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Tenable
Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)
blogs_tenable·2024-02-13·CVSS 7.6
[HIGH] Microsoft’s February 2024 Patch Tuesday Addresses 73 CVEs (CVE-2024-21351, CVE-2024-21412)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Over 20,000 vulnerable Microsoft Exchange servers exposed to attacks
blogs_bleepingcomputer·2023-12-02
Over 20,000 vulnerable Microsoft Exchange servers exposed to attacks
## Over 20,000 vulnerable Microsoft Exchange servers exposed to attacks
## Ionut Ilascu
Tens of thousands of Microsoft Exchange email servers in Europe, the U.S., and Asia exposed on the public internet are vulnerable to remote code execution flaws.
The mail systems run a software version that is currently unsupported and no longer receives any type of updates, being vulnerable to multiple security issues, some with a critical severity rating.
## Exchange Server 2007 still running
Internet scans from The ShadowServer Foundation show that there are close to 20,000 Microsoft Exchange servers currently reachable over the public internet that have reached the end-of-life (EoL) stage.
On Friday, more than half of the systems were located in Europe. In North America, there were 6,038 Excha
Qualys
Safeguard Your Organization this Holiday Season with Endpoint Security from Qualys
blogs_qualys·2023-10-26·CVSS 8.8
[HIGH] Safeguard Your Organization this Holiday Season with Endpoint Security from Qualys
## Table of Contents
Understanding the Holiday Cyber Threat Landscape
Why are cyber threats active during the holiday season?
The Morale Factor of Holiday Cyber Threats
Best Practices for Protecting Your Organization Over the Holidays
Qualys Customers Offer: Gain Peace of Mind with Qualys Endpoint Security
The holiday season is approaching, bringing joy, family gatherings, and celebrations. As we dust off the decorations and begin drafting shopping lists, security professionals must grapple with an underlying concern: the increased risk of cyberattacks.
Year-end festivities bring a rise in online activities – shopping, holiday greetings, and more. Unfortunately, this bustling digital activity attracts cybercriminals ready to exploit the season’s goodwill, creating an enormous risk o
Qualys
Safeguard Your Organization this Holiday Season with Endpoint Security from Qualys | Qualys
blogs_qualys·2023-10-26·CVSS 8.8
[HIGH] Safeguard Your Organization this Holiday Season with Endpoint Security from Qualys | Qualys
#### Table of Contents
- Understanding the Holiday Cyber Threat Landscape
- Why are cyber threats active during the holiday season?
- The Morale Factor of Holiday Cyber Threats
- Best Practices for Protecting Your Organization Over the Holidays
- Qualys Customers Offer: Gain Peace of Mind with Qualys Endpoint Security
The holiday season is approaching, bringing joy, family gatherings, and celebrations. As we dust off the decorations and begin drafting shopping lists, security professionals must grapple with an underlying concern: the increased risk of cyberattacks.
Year-end festivities bring a rise in online activities – shopping, holiday greetings, and more. Unfortunately, this bustling digital activity attracts cybercriminals ready to exploit the season’s goodwill, creating an enormou
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Microsoft’s February 2023 Patch Tuesday Addresses 75 CVEs (CVE-2023-23376)
blogs_tenable·2023-02-14·CVSS 7.8
[HIGH] Microsoft’s February 2023 Patch Tuesday Addresses 75 CVEs (CVE-2023-23376)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
ProxyNotShell, OWASSRF, TabShell: Patch Your Microsoft Exchange Servers Now
blogs_tenable·2023-01-31
ProxyNotShell, OWASSRF, TabShell: Patch Your Microsoft Exchange Servers Now
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Huntress
OWASSRF Explained: Analyzing the Microsoft Exchange RCE Vulnerability | Huntress
blogs_huntress·2022-12-29·CVSS 9.8
CVE-2022-41080 [CRITICAL] OWASSRF Explained: Analyzing the Microsoft Exchange RCE Vulnerability | Huntress
We simply couldn’t end the year 2022 on a calm note—hackers made sure of that with their latest Microsoft Exchange exploit.
On December 22, Huntress observed a significant increase in malicious PowerShell executions delivering a ConnectWise Control (ScreenConnect) payload on unpatched Exchange hosts using the exploit chain consisting of CVE-2022-41080 and CVE-2022-41082 . This exploit chain was coined “OWASSRF” by Crowdstrike , as it involves an Outlook Web Access server-side request forgery. The exploit chain relates to ProxyNotShell, but it bypasses the mitigation guidance Microsoft provided in September prior to releasing their patch.
Keep reading for our analysis of how the OWASSRF exploit works, how it achieves remote code execution and what you should know to stay protected.
## Ho
Checkpoint
26th December – Threat Intelligence Report
blogs_checkpoint·2022-12-26
CVE-2022-41080 26th December – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 26th December – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 26th December, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
LastPass revealed that it has been breached for the second time this year, an event that resulted in attackers stealing customer encrypted password vaults and additional account information. The breach was achieved after attackers used information stolen from the LastPass development environment in the August incident to
Unit42
Threat Brief: OWASSRF Vulnerability Exploitation
blogs_unit42·2022-12-23·CVSS 8.8
CVE-2022-41080 [HIGH] Threat Brief: OWASSRF Vulnerability Exploitation
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: OWASSRF Vulnerability Exploitation
Robert Falcone
Lior Rochberger
Published: December 22, 2022
High Profile Threats
Vulnerabilities
Backdoor
CVE-2022-41080
CVE-2022-41082
Microsoft Exchange Server
OWASSRF
ProxyNotShell
SilverArrow
## Executive Summary
On Dec. 20, 2022, CrowdStrike published a blog discussing a new exploit method for Microsoft Exchange Server, which they named OWASSRF, referring to server-side request forgery in relation to Outlook on the web. (Outlook on the web is known as both Outlook Web Access and Outlook Web Application.)
The OWASSRF exploit method involves two different vulnerabilities tracked by CVE-2022-41080 and CVE-2022-41082 that allow remote code execution (RCE) v
Unit42
Threat Brief: OWASSRF Vulnerability Exploitation
blogs_unit42·2022-12-23·CVSS 8.8
CVE-2022-41080 [HIGH] Threat Brief: OWASSRF Vulnerability Exploitation
## Executive Summary
On Dec. 20, 2022, CrowdStrike published a blog discussing a new exploit method for Microsoft Exchange Server, which they named OWASSRF, referring to server-side request forgery in relation to Outlook on the web. (Outlook on the web is known as both Outlook Web Access and Outlook Web Application.)
The OWASSRF exploit method involves two different vulnerabilities tracked by CVE-2022-41080 and CVE-2022-41082 that allow remote code execution (RCE) via Outlook Web Access (OWA). The CVE-2022-41082 vulnerability was previously used by the ProxyNotShell exploit. However, the OWASSRF exploit method bypasses mitigations previously provided by Microsoft for ProxyNotShell. OWASSRF requires authentication to the Exchange Server prior to exploitation, thus we are seeing isolated r
Wiz
OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog
blogs_wiz·2022-12-22·CVSS 8.8
CVE-2022-41080 [HIGH] OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog
A new exploit method, referred to as OWASSRF, has been discovered by researchers and exploited in the wild. This exploit combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution (RCE) through Outlook Web Access (OWA). The OWASSRF exploit successfully bypasses URL rewrite mitigations previously provided by Microsoft for ProxyNotShell.
## What is OWASSRF?
On September 29, 2022, reports emerged of active exploitation of two zero-day vulnerabilities in Microsoft Exchange, which could allow remote code execution (RCE). These vulnerabilities were identified by Microsoft as CVE-2022-41040, a server-side request forgery (SSRF) vulnerability, and CVE-2022-41082, which allows RCE. These vulnerabilities were collectively referred to as ProxyNotShell.
On December 20th, researchers
Wiz
OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog
blogs_wiz·2022-12-22·CVSS 8.8
CVE-2022-41080 [HIGH] OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog
A new exploit method, referred to as OWASSRF, has been discovered by researchers and exploited in the wild. This exploit combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution (RCE) through Outlook Web Access (OWA). The OWASSRF exploit successfully bypasses URL rewrite mitigations previously provided by Microsoft for ProxyNotShell.
# What is OWASSRF?
On September 29, 2022, reports emerged of active exploitation of two zero-day vulnerabilities in Microsoft Exchange, which could allow remote code execution (RCE). These vulnerabilities were identified by Microsoft as CVE-2022-41040, a server-side request forgery (SSRF) vulnerability, and CVE-2022-41082, which allows RCE. These vulnerabilities were collectively referred to as ProxyNotShell.
On December 20th, researchers
Securelist
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
blogs_securelist·2022-12-19·CVSS 6.6
CVE-2022-41040 [MEDIUM] CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
Table of Contents
- Summary
- ProxyNotShell exploitation details
- ProxyNotShell post exploitation
- Our recommendations
- Indicators of compromise
Authors
- Vitaly Morgunov
- Dmitry Kondratyev
- Alexander Kolesnikov
- Alexey Kulaev
## Summary
At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the investigation, experts found that two 0-day vulnerabilities in Microsoft Exchange Server were used in the attack. The first one, later identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to remotely trigger the next vulnerability – CVE-2022-41082. The second vulnerability, in turn, allows remote code execution (RCE) when MS Exchange PowerShell is accessible to the
Securelist
CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
blogs_securelist·2022-12-19·CVSS 6.6
[MEDIUM] CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange
Table of Contents
Summary
ProxyNotShell exploitation details
ProxyNotShell post exploitation
Our recommendations
Indicators of compromise
Authors
Vitaly Morgunov
Dmitry Kondratyev
Alexander Kolesnikov
Alexey Kulaev
## Summary
At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the investigation, experts found that two 0-day vulnerabilities in Microsoft Exchange Server were used in the attack. The first one, later identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to remotely trigger the next vulnerability – CVE-2022-41082. The second vulnerability, in turn, allows remote code execution (RCE) when MS Exchange PowerShell is accessible to the attacker. A
Securelist
IT threat evolution in Q3 2022. Non-mobile statistics
blogs_securelist·2022-11-18
IT threat evolution in Q3 2022. Non-mobile statistics
Table of Contents
Quarterly figures
Financial threats
Number of users attacked by banking malware
TOP 10 banking malware families
Geography of financial malware attacks
Ransomware programs
Quarterly trends and highlights
Number of new modifications
Number of users attacked by ransomware Trojans
Geography of attacked users
TOP 10 most common families of ransomware Trojans
Miners
Number of new miner modifications
Number of users attacked by miners
Geography of miner attacks
Vulnerable applications used by criminals during cyberattacks
Quarterly highlights
Vulnerability statistics
Attacks on macOS
TOP 20 threats for macOS
Geography of threats for macOS
IoT attacks
IoT threat statistics
Attacks via web resources
Countries and territories that serve as sources of web-ba
Securelist
PC malware statistics, Q3 2022
blogs_securelist·2022-11-18
PC malware statistics, Q3 2022
Table of Contents
- Quarterly figures
- Financial threats
- Ransomware programs
- Miners
- Vulnerable applications used by criminals during cyberattacks
- Attacks on macOS
- IoT attacks
- Attacks via web resources
- Local threats
Authors
- AMR
- IT threat evolution in Q3 2022
- IT threat evolution in Q3 2022. Non-mobile statistics
- IT threat evolution in Q3 2022. Mobile statistics
These statistics are based on detection verdicts of Kaspersky products and services received from users who consented to providing statistical data.
## Quarterly figures
According to Kaspersky Security Network, in Q3 2022:
- Kaspersky solutions blocked 956,074,958 attacks from online resources across the globe.
- Web Anti-Virus recognized 251,288,987 unique URLs as malicious.
- Attempts to run malware fo
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
## Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative Nov 16, 2022 Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
# Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative
2022/11/16
Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it ca
Trendmicro
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
blogs_trendmicro·2022-11-16·CVSS 9.1
CVE-2022-41040 [CRITICAL] Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
## Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend
By: Zero Day Initiative 2022/11/16 Read time: ( words)
Save to Folio
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release.
It is a beautiful chain, with an ingenious vector for gaining remote code execution. The tricky part is that it ca
Krebs
Patch Tuesday, November 2022 Election Edition
blogs_krebs·2022-11-09·CVSS 7.8
[HIGH] Patch Tuesday, November 2022 Election Edition
Let’s face it: Having “2022 election” in the headline above is probably the only reason anyone might read this story today. Still, while most of us here in the United States are anxiously awaiting the results of how well we’ve patched our Democracy, it seems fitting that Microsoft Corp. today released gobs of security patches for its ubiquitous Windows operating systems. November’s patch batch includes fixes for a whopping six zero-day security vulnerabilities that miscreants and malware are already exploiting in the wild.
Probably the scariest of the zero-day flaws is CVE-2022-41128 , a “critical” weakness in the Windows scripting languages that could be used to foist malicious software on vulnerable users who do nothing more than browse to a hacked or malicious site that exploits the we
Krebs
Patch Tuesday, November 2022 Election Edition
blogs_krebs·2022-11-09·CVSS 7.8
[HIGH] Patch Tuesday, November 2022 Election Edition
Let’s face it: Having “2022 election” in the headline above is probably the only reason anyone might read this story today. Still, while most of us here in the United States are anxiously awaiting the results of how well we’ve patched our Democracy, it seems fitting that Microsoft Corp. today released gobs of security patches for its ubiquitous Windows operating systems. November’s patch batch includes fixes for a whopping six zero-day security vulnerabilities that miscreants and malware are already exploiting in the wild.
Probably the scariest of the zero-day flaws is CVE-2022-41128, a “critical” weakness in the Windows scripting languages that could be used to foist malicious software on vulnerable users who do nothing more than browse to a hacked or malicious site that exploits the wea
Qualys
November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).
blogs_qualys·2022-11-08·CVSS 7.5
[HIGH] November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).
## Table of Contents
Microsoft Patch Tuesday Summary
The November 2022 Microsoft Vulnerabilities are Classified as Follows:
OpenSSL 3.x Critical Vulnerability Highlights
OpenSSL 3.x Related Blogs and Resources
Microsoft Addressed Six Zero-Day Vulnerabilities
Microsoft Patch Tuesday Critical Vulnerability Highlights
Microsoft Release Summary
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Research Blog Posts
Qualys Threat Protection High-Rated Advisories
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
Rapid Response with Patch Management (PM)
Extend the Power of VMDR to Enterprise Mobile Devices With Qualys VMDR Mobile
Execute Mitigation UsingCustom Assessment and Remediation(CAR)
Patch Tuesday Is
Tenable
Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)
blogs_tenable·2022-11-08·CVSS 7.8
[HIGH] Microsoft’s November 2022 Patch Tuesday Addresses 62 CVEs (CVE-2022-41073)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years). | Qualys
blogs_qualys·2022-11-08·CVSS 7.5
[HIGH] November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years). | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The November 2022 Microsoft Vulnerabilities are Classified as Follows:
- OpenSSL 3.x Critical Vulnerability Highlights
- OpenSSL 3.x Related Blogs and Resources
- Microsoft Addressed Six Zero-Day Vulnerabilities
- Microsoft Patch Tuesday Critical Vulnerability Highlights
- Microsoft Release Summary
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Research Blog Posts
- Qualys Threat Protection High-Rated Advisories
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
- Rapid Response with Patch Management (PM)
- Extend the Power of VMDR to Enterprise Mobile Devices With Qualys VMDR Mobile
- Execute Mitigation UsingCustom Assessment and Remediation(CAR)
Qualys
Qualys Research Team: Threat Thursdays, October 2022
blogs_qualys·2022-10-28
Qualys Research Team: Threat Thursdays, October 2022
## Table of Contents
From the Qualys Blog
New Tools & Techniques
New Vulnerabilities
Noteworthy Mentions
Threat Thursdays Webinar
Welcome to the third edition of the Qualys Research Team’s “Threat Research Thursday”, where we collect and curate notable new tools, techniques, procedures, threat intelligence, cybersecurity news, malware attacks, and more. Feedback on our second edition, Qualys Threat Research Thursday , is more than welcome. We would love to hear from you!
## From the Qualys Blog
Here is a roundup of the most interesting blogs from the Qualys Research Team over the past couple of weeks:
Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform – How do you detect the ProxyNotShell vulnerability that was released a month a
Qualys
Qualys Research Team: Threat Thursdays, October 2022 | Qualys
blogs_qualys·2022-10-28·CVSS 7.8
[HIGH] Qualys Research Team: Threat Thursdays, October 2022 | Qualys
#### Table of Contents
- From the Qualys Blog
- New Tools & Techniques
- New Vulnerabilities
- Noteworthy Mentions
- Threat Thursdays Webinar
Welcome to the third edition of the Qualys Research Team’s “Threat Research Thursday”, where we collect and curate notable new tools, techniques, procedures, threat intelligence, cybersecurity news, malware attacks, and more. Feedback on our second edition, Qualys Threat Research Thursday, is more than welcome. We would love to hear from you!
## From the Qualys Blog
Here is a roundup of the most interesting blogs from the Qualys Research Team over the past couple of weeks:
- Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform – How do you detect the ProxyNotShell vulnerability that was released
Qualys
October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical. | Qualys
blogs_qualys·2022-10-11·CVSS 7.8
[HIGH] October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical. | Qualys
#### Table of Contents
- Microsoft Patch Tuesday Summary
- Microsoft Exchange ProxyNotShell Zero-Days Not Yet Addressed (QID 50122)
- The October 2022 Microsoft Vulnerabilities Are Classified As Follows:
- Two Zero-Day Vulnerabilities Addressed
- Microsoft Critical Vulnerability Highlights
- Microsoft Release Summary
- Microsoft Edge | Last But Not Least
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Research Blog Posts
- Qualys Threat Protection High-Rated Advisories
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
- Rapid Response With Patch Management (PM)
- EXECUTE Mitigation Using Custom Assessment and Remediation (CAR)
- EVALUATE Vendor-Suggested Mitigation With Policy Compliance (PC)
- This Month
Qualys
October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical.
blogs_qualys·2022-10-11·CVSS 7.8
[HIGH] October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
Microsoft Exchange ProxyNotShell Zero-Days Not Yet Addressed (QID 50122)
The October 2022 Microsoft Vulnerabilities Are Classified As Follows:
Two Zero-Day Vulnerabilities Addressed
Microsoft Critical Vulnerability Highlights
Microsoft Release Summary
Microsoft Edge | Last But Not Least
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Research Blog Posts
Qualys Threat Protection High-Rated Advisories
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response(VMDR)
Rapid Response With Patch Management (PM)
EXECUTE Mitigation Using Custom Assessment and Remediation (CAR)
EVALUATE Vendor-Suggested Mitigation With Policy Compliance (PC)
This Month in Vulnerabilities
Tenable
Microsoft’s October 2022 Patch Tuesday Addresses 84 CVEs (CVE-2022-41033)
blogs_tenable·2022-10-11·CVSS 7.8
[HIGH] Microsoft’s October 2022 Patch Tuesday Addresses 84 CVEs (CVE-2022-41033)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Zscaler
Coverage Advisory For MS Exchange Server Vulnerabilities
blogs_zscaler·2022-10-07·CVSS 8.8
[HIGH] Coverage Advisory For MS Exchange Server Vulnerabilities
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Talos
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
blogs_talos·2022-10-06
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
As I wrote about last week, I’ve been diving a lot into apps’ privacy policies recently. And I was recently made aware of a new type of app I never knew existed — family trackers.
There are countless mobile apps for parents to track their children or other family members based on their location, phone usage, and even driving speed. As an anxious soon-to-be-parent, this sounds intriguing to me — it’d be a supped-up version of Find my Friends on Apple devices so I’d never have to ask my teenager (granted, I’m many years away from being at that stage of my life) when they were coming home or where they were.
Just as with all other types of mobile apps, there are pitfalls, though.
Life360, one of the most popular of these types of apps and even tells users what their maximum driving speed w
Talos
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
blogs_talos·2022-10-06
Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
## Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole
As I wrote about last week , I’ve been diving a lot into apps’ privacy policies recently . And I was recently made aware of a new type of app I never knew existed — family trackers.
There are countless mobile apps for parents to track their children or other family members based on their location, phone usage, and even driving speed. As an anxious soon-to-be-parent, this sounds intriguing to me — it’d be a supped-up version of Find my Friends on Apple devices so I’d never have to ask my teenager (granted, I’m many years away from being at that stage of my life) when they were coming home or where they were.
Just as with all other types of mobile apps, there are pitfalls, though.
Life360, one of
Unit42
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
blogs_unit42·2022-10-04·CVSS 6.6
CVE-2022-41040 [MEDIUM] Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
## Executive Summary
In early August, GTSC discovered a new Microsoft Exchange zero-day remote code execution (RCE) that was very similar to ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207).
The exploit was discovered in the wild in what appeared to be a SOC investigation into suspicious activity of one of GTSC’s customers. Once they determined the scope of the vulnerabilities, GTSC reported the vulnerability to the Zero-day Initiative (ZDI) to enable further coordination with Microsoft. The vulnerabilities were assigned CVE-2022-41040 and CVE-2022-41082 and rated with severities of critical and important respectively. The first one, identified as CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability, while the second one, identified as CVE-2022-41082, allow
Unit42
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
blogs_unit42·2022-10-04·CVSS 6.6
CVE-2022-41040 [MEDIUM] Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
Shawn Westfall
Published: October 4, 2022
High Profile Threats
Vulnerabilities
CVE-2022-41040
CVE-2022-41082
Exploit in the wild
Microsoft Exchange Server
ProxyNotShell
Threat intelligence
## Executive Summary
In early August, GTSC discovered a new Microsoft Exchange zero-day remote code execution (RCE) that was very similar to ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207).
The exploit was discovered in the wild in what appeared to be a SOC investigation into suspicious activity of one of GTSC’s customers. Once they determined the scope of the vulnerabilities, GTSC reported the vulnerability to the Zer
Checkpoint
3rd October – Threat Intelligence Report
blogs_checkpoint·2022-10-03
CVE-2022-41040 3rd October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd October, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Check Point Research identified an ongoing, mobile malware campaign that has consistently targeted Uyghurs for at least the past seven years. Attributed to the actor Scarlet Mimic, the malware campaign was disguised in multiple baits such as books, pictures, and even an audio version of the Quran.
Check Point Harmony Mobil
Qualys
Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform
blogs_qualys·2022-09-30·CVSS 8.8
[HIGH] Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform
## Table of Contents
Qualys Vulnerability Coverage (QID)
Detect ProxyNotShell Using Qualys VMDR
Microsoft Guidance for Risk Mitigation of ProxyNotShell
Detect Malicious Behavior related to ProxyNotShell using Qualys Multi-Vector EDR
Indicators of Compromise (IOCs) for ProxyNotShell
Contributors
On September 29, 2022, active attacks against Microsoft Exchange were reported by Vietnamese cybersecurity company GTSC. The researcher at GTSC reported two critical vulnerabilities (now named “ProxyNotShell”) in Microsoft Exchange Server via two advisories issued by Zero Day Initiative : ZDI-CAN-18333 and ZDI-CAN-18802 .
The first flaw (CVE-2022-41040) is a Server-Side Request Forgery (SSRF) vulnerability. The second flaw (CVE-2022-41082) allows remote code execution (RCE) when PowerShell i
Tenable
CVE-2022-41040 and CVE-2022-41082: ProxyShell Variant Exploited in the Wild
blogs_tenable·2022-09-30·CVSS 8.8
[HIGH] CVE-2022-41040 and CVE-2022-41082: ProxyShell Variant Exploited in the Wild
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
blogs_talos·2022-09-30·CVSS 8.8
[HIGH] Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
## Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
Cisco Talos has released new coverage to detect and prevent the exploitation of two recently disclosed vulnerabilities collectively referred to as "ProxyNotShell," affecting Microsoft Exchange Servers 2013, 2016 and 2019. One of these vulnerabilities could allow an attacker to execute remote code on the targeted server. Limited exploitation of these vulnerabilities in the wild has been reported. CVE-2022-41040 is a Server Side Request Forgery (SSRF) vulnerability, while CVE-2022-41082 enables Remote Code Execution (RCE) when PowerShell is accessible to the attackers. While no fixes or patches are available yet, Microsoft has provided mitigations for on-premises Microsoft Exchange users on Sept. 29
Qualys
Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform | Qualys
blogs_qualys·2022-09-30·CVSS 8.8
[HIGH] Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform | Qualys
#### Table of Contents
- Qualys Vulnerability Coverage (QID)
- Detect ProxyNotShell Using Qualys VMDR
- Microsoft Guidance for Risk Mitigation of ProxyNotShell
- Detect Malicious Behavior related to ProxyNotShell using Qualys Multi-Vector EDR
- Indicators of Compromise (IOCs) for ProxyNotShell
- Contributors
On September 29, 2022, active attacks against Microsoft Exchange were reported by Vietnamese cybersecurity company GTSC. The researcher at GTSC reported two critical vulnerabilities (now named “ProxyNotShell”) in Microsoft Exchange Server via two advisories issued by Zero Day Initiative: ZDI-CAN-18333 and ZDI-CAN-18802.
The first flaw (CVE-2022-41040) is a Server-Side Request Forgery (SSRF) vulnerability. The second flaw (CVE-2022-41082) allows remote code execution (RCE) when Power
Krebs
Microsoft: Two New 0-Day Flaws in Exchange Server
blogs_krebs·2022-09-30·CVSS 8.8
[HIGH] Microsoft: Two New 0-Day Flaws in Exchange Server
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.
In customer guidance released Thursday, Microsoft said it is investigating two reported zero-day flaws affecting Microsoft Exchange Server 2013, 2016, and 2019. CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability that can enable an authenticated attacker to remotely trigger the second zero-day vulnerability — CVE-2022-41082 — which allows remote code execution (RCE) when Po
Fortinet
Microsoft Exchange 0-Day Vulnerability Updates | FortiGuard Labs
blogs_fortinet·2022-09-30·CVSS 6.6
CVE-2022-41040 [MEDIUM] Microsoft Exchange 0-Day Vulnerability Updates | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Microsoft Exchange 0-Day Vulnerability Updates
By James Slaughter | September 30, 2022
On 28th September, 2022, the cybersecurity company GTSC released a blog detailing an exploit attempt on a system they were monitoring. After analysis, they were able to locate and submit two bugs to Microsoft via the Zero Day Initiative (ZDI-CAN-18333 (CVSS 8.8) and ZDI-CAN-18802 (CVSS 6.3)). Microsoft validated the findings and CVE-2022-41040 and CVE-2022-41082 were assigned to the vulnerabilities.
CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability and CVE-2022-41082 allows for remote code execution (RCE) where PowerShell is available.
This blog describes what you need to know about these vulnerabilities.
Affected Platforms: On premises Microsoft Ex
Talos
Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
blogs_talos·2022-09-30·CVSS 8.8
CVE-2022-41040 [HIGH] Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
Cisco Talos has released new coverage to detect and prevent the exploitation of two recently disclosed vulnerabilities collectively referred to as "ProxyNotShell," affecting Microsoft Exchange Servers 2013, 2016 and 2019. One of these vulnerabilities could allow an attacker to execute remote code on the targeted server. Limited exploitation of these vulnerabilities in the wild has been reported. CVE-2022-41040 is a Server Side Request Forgery (SSRF) vulnerability, while CVE-2022-41082 enables Remote Code Execution (RCE) when PowerShell is accessible to the attackers.
While no fixes or patches are available yet, Microsoft has provided mitigations for on-premises Microsoft Exchange users on Sept. 29, 2022. Even organizations that use Exchange Online may still be affected if they run a hybri
Krebs
Microsoft: Two New 0-Day Flaws in Exchange Server
blogs_krebs·2022-09-30·CVSS 8.8
[HIGH] Microsoft: Two New 0-Day Flaws in Exchange Server
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server , a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.
In customer guidance released Thursday, Microsoft said it is investigating two reported zero-day flaws affecting Microsoft Exchange Server 2013, 2016, and 2019. CVE-2022-41040 , is a Server-Side Request Forgery (SSRF) vulnerability that can enable an authenticated attacker to remotely trigger the second zero-day vulnerability — CVE-2022-41082 — which allows remote code execution (RCE) when
Huntress
New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
blogs_huntress·2022-09-29·CVSS 8.8
[HIGH] New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
Our team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers that could lead to Remote Code Execution (RCE) for an authenticated user.
Our ThreatOps team discovered this blog , and the team began to research and see if anyone else in the community had flagged it. We found this tweet from Security Researcher Kevin Beaumont, where he notes that “significant numbers of Exchange servers have been backdoored - including a honeypot.”
We’ll continue to update this blog with our latest findings and research.
## Updates
Update 1 (9/29/22 @ 8:18pm ET) : Clarified GTSC updated language to affirm this is a new vulnerability and 0-day.
Update 2 (9/30/22 @ 9:23am ET) : Included Microsoft official details and CVE identifiers.
## What You Need to Know
As of 9/29/22 @ 8
Recorded Future
Beyond the Code: Unearthing the Subtle Business Ramifications of Six Months in Vulnerabilities
blogs_recorded_future·CVSS 8.0
[HIGH] Beyond the Code: Unearthing the Subtle Business Ramifications of Six Months in Vulnerabilities
## Beyond the Code: Unearthing the Subtle Business Ramifications of Six Months in Vulnerabilities
Editor's note: The following blog post originally appeared on Levi Gundert's Substack page .
At Recorded Future , we’re determined to iteratively answer the “So What? Now What?” (SW/NW) questions, which some intelligence professionals colloquially characterize as “actionability.” Insikt Group often engages in a “non-obvious second-order implications” (NOSOI) exercise to derive quality SWNW answers from geopolitical and cyber intelligence for business executives. NOSOI results vary (GPT-4 is good at “second-order” but less adept at “non-obvious”), and of course, “non-obvious” is a subjective label. Still, it’s a reasonable articulation of our goal, and we know it when we see it.
Toward an ex
Crowdstrike
OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Greynoiseio
GreyNoise
blogs_greynoiseio·CVSS 8.8
[HIGH] GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Recorded Future
Beyond the Code: Unearthing the Subtle Business Ramifications of Six Months in Vulnerabilities
blogs_recorded_future·CVSS 8.0
[HIGH] Beyond the Code: Unearthing the Subtle Business Ramifications of Six Months in Vulnerabilities
# Beyond the Code: Unearthing the Subtle Business Ramifications of Six Months in Vulnerabilities
Editor's note: The following blog post originally appeared on Levi Gundert's Substack page.
Image provided by authors
At Recorded Future, we’re determined to iteratively answer the “So What? Now What?” (SW/NW) questions, which some intelligence professionals colloquially characterize as “actionability.” Insikt Group often engages in a “non-obvious second-order implications” (NOSOI) exercise to derive quality SWNW answers from geopolitical and cyber intelligence for business executives. NOSOI results vary (GPT-4 is good at “second-order” but less adept at “non-obvious”), and of course, “non-obvious” is a subjective label. Still, it’s a reasonable articulation of our goal, and we know it when
Zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
blogs_zscaler
CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day | CXO Revolutiona
## CISO Monthly Roundup, October 2022: ThreatLabz Data Loss Report; PHP Ducktail infostealer; LilithBot malware; vulnerabilities in OpenSSL, Microsoft, and Apache; Windows CLFS zero-day
Deepen Desai
Contributor
Zscaler
## Nov 2, 2022
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research and relevant insights on cyber-related subjects from the ThreatLabz team and Deepen Desai, CISO at Zscaler.
The CISO Monthly Roundup (formerly the ThreatLabz monthly report) provides the latest threat research from Deepen Desai and the ThreatLabz team, along with insights on other cyber-related subjects. In October, ThreatLabz released their 2022 Data Loss Report, researched a PHP version of Ducktail infostealer, and analyzed LilithBot malware. My team a
Crowdstrike
October Patch Tuesday 2022: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] October Patch Tuesday 2022: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Threat Intel
Play (Play)
threat_intel·CVSS 9.1
[CRITICAL] Play (Play)
# Threat Actor Profile: Play
ATT&CK ID: G1040
Also known as: Play
## Overview
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
## Techniques (TTPs)
### Resource Development
- T1587.001 Malware
Usage: Play developed and employ Playcrypt ransomware.(Citation: Trend Micro Ransomware Spotlight Play July 2023)(Citation: CISA Play Ransomware A
Huntress
OWASSRF Explained: Analyzing the Microsoft Exchange RCE Vulnerability | Huntress
blogs_huntress·CVSS 9.8
CVE-2022-41080 [CRITICAL] OWASSRF Explained: Analyzing the Microsoft Exchange RCE Vulnerability | Huntress
We simply couldn’t end the year 2022 on a calm note—hackers made sure of that with their latest Microsoft Exchange exploit.
On December 22, Huntress observed a significant increase in malicious PowerShell executions delivering a ConnectWise Control (ScreenConnect) payload on unpatched Exchange hosts using the exploit chain consisting of CVE-2022-41080 and CVE-2022-41082. This exploit chain was coined “OWASSRF” by Crowdstrike, as it involves an Outlook Web Access server-side request forgery. The exploit chain relates to ProxyNotShell, but it bypasses the mitigation guidance Microsoft provided in September prior to releasing their patch.
Keep reading for our analysis of how the OWASSRF exploit works, how it achieves remote code execution and what you should know to stay protected.
## How
Crowdstrike
October Patch Tuesday 2022: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] October Patch Tuesday 2022: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Greynoiseio
GreyNoise Analysis Of A Quartet of Exchange Remote Code Execution Vulnerabilities: CVE-2023-21529; CVE-2023-21706; CVE-2023-21707; CVE-2023-21710
blogs_greynoiseio·CVSS 8.8
[HIGH] GreyNoise Analysis Of A Quartet of Exchange Remote Code Execution Vulnerabilities: CVE-2023-21529; CVE-2023-21706; CVE-2023-21707; CVE-2023-21710
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Crowdstrike
OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] OWASSRF: CrowdStrike Identifies New Exploit Method for Exchange Bypassing ProxyNotShell Mitigations
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
November 2022 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] November 2022 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Huntress
New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
blogs_huntress·CVSS 8.8
[HIGH] New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress
Our team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers that could lead to Remote Code Execution (RCE) for an authenticated user.
Our ThreatOps team discovered this blog, and the team began to research and see if anyone else in the community had flagged it. We found this tweet from Security Researcher Kevin Beaumont, where he notes that “significant numbers of Exchange servers have been backdoored - including a honeypot.”
We’ll continue to update this blog with our latest findings and research.
## Updates
Update 1 (9/29/22 @ 8:18pm ET): Clarified GTSC updated language to affirm this is a new vulnerability and 0-day.
Update 2 (9/30/22 @ 9:23am ET): Included Microsoft official details and CVE identifiers.
## What You Need to Know
As of 9/29/22 @ 8:18
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082https://www.kb.cert.org/vuls/id/915563https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-scripthttps://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-scripthttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082
2022-10-03
Published
2022-09-30
Added to CISA KEV
Exploited in the wild