CVE-2022-41082
Microsoft Exchange Server Remote Code Execution Vulnerability
Description
CVE-2022-41082, known as part of the "ProxyNotShell" attack chain, is a remote code execution vulnerability in Microsoft Exchange Server that allows an authenticated attacker to execute arbitrary code on the server. This vulnerability is typically chained with CVE-2022-41040 (a server-side request forgery flaw) to achieve unauthenticated remote code execution. With an EPSS score of 91.19% (99.65th percentile), CVE-2022-41082 is one of the most actively exploited Exchange vulnerabilities. CISA added it to the KEV catalog on September 30, 2022, and it has been confirmed as used in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | exchange server | 2013; 2016; 2019 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082(Vendor Advisory)
- http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082(Patch, Vendor Advisory)
- https://www.kb.cert.org/vuls/id/915563(Third Party Advisory, US Government Resource)
- https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-script(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-script(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2022-41082 exploits a code injection weakness in Microsoft Exchange Server's PowerShell backend. An authenticated attacker can inject and execute arbitrary code through the Exchange PowerShell remoting endpoint, gaining code execution with SYSTEM privileges on the Exchange server.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2022-41082 enables authenticated remote code execution on Microsoft Exchange Server, one of the most critical infrastructure components in enterprise environments. While the vulnerability itself requires authentication, when chained with CVE-2022-41040 (SSRF), the authentication requirement is bypassed, enabling fully unauthenticated remote code execution. Confidentiality, integrity, and availability are critically impacted: a successful exploit grants SYSTEM-level access to the Exchange server, exposing all corporate email data, enabling lateral movement into Active Directory, and potentially compromising the entire domain. The confirmed use in ransomware campaigns and the EPSS score of 91.19% make this a critical-priority vulnerability for any organization running Exchange Server.
Exploit Maturity
CISA confirmed active exploitation of CVE-2022-41082 and added it to the KEV catalog on September 30, 2022, with a remediation deadline of October 21, 2022. The vulnerability has been confirmed as used in ransomware campaigns, making it one of the most dangerous Exchange vulnerabilities in recent years. The EPSS score of 91.19% (99.65th percentile) indicates near-certain exploitation activity. When chained with CVE-2022-41040, the combined ProxyNotShell attack achieves unauthenticated remote code execution, and this chain has been widely exploited by multiple threat groups including state-sponsored actors.
Remediation
- Apply Microsoft security updates: Install the November 2022 Exchange Server security updates (KB5019758) that address both CVE-2022-41082 and CVE-2022-41040.
- Apply URL Rewrite mitigations: If immediate patching is not possible, implement the Microsoft-recommended URL Rewrite rule to block exploitation attempts targeting the PowerShell endpoint.
- Disable remote PowerShell for non-admin users: Restrict Exchange PowerShell remoting access to only essential administrative accounts.
- Scan for indicators of compromise: Search for webshells in Exchange directories, review Exchange logs for suspicious PowerShell execution, and check for unauthorized mailbox access or forwarding rules.
- Consider migration to Exchange Online: Evaluate moving to Microsoft 365/Exchange Online to reduce the attack surface associated with on-premises Exchange Server management.
Technical Details
CVE-2022-41082 targets the PowerShell remoting endpoint in Microsoft Exchange Server, which is accessible via the Autodiscover service. The vulnerability allows an authenticated attacker to invoke PowerShell cmdlets that lead to arbitrary code execution with SYSTEM privileges on the Exchange server. In the ProxyNotShell attack chain, CVE-2022-41040 (SSRF) is first used to access the PowerShell backend endpoint by exploiting the Autodiscover mechanism, bypassing front-end URL normalization. Once access to the PowerShell endpoint is obtained, CVE-2022-41082 is triggered to execute arbitrary commands. The attack is functionally similar to the earlier ProxyShell vulnerability chain but uses a different SSRF mechanism. Exchange Server's high-privilege execution context and central role in enterprise infrastructure make successful exploitation particularly devastating.
Frequently Asked Questions
Is CVE-2022-41082 being actively exploited?
Yes, CVE-2022-41082 is being actively exploited and is confirmed as used in ransomware campaigns. CISA added it to the KEV catalog on September 30, 2022. The EPSS score of 91.19% indicates near-certain exploitation, and the ProxyNotShell chain has been widely deployed by multiple threat groups.
What products are affected by CVE-2022-41082?
CVE-2022-41082 affects Microsoft Exchange Server 2013, 2016, and 2019. Exchange Online (Microsoft 365) is not affected. The vulnerability is most dangerous when chained with CVE-2022-41040 for unauthenticated exploitation.
How do I fix CVE-2022-41082?
Apply the November 2022 Exchange Server security updates. As a temporary mitigation, implement the URL Rewrite rule recommended by Microsoft to block exploitation of the PowerShell endpoint.
How severe is CVE-2022-41082?
CVE-2022-41082 is a critical remote code execution vulnerability with an EPSS score of 91.19% (99.65th percentile) and confirmed ransomware usage. When chained with CVE-2022-41040, it enables unauthenticated remote code execution on Exchange Server.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.