Threat Advisory: Microsoft warns of actively exploited vulnerabilities in Exchange Server
Summary: Cisco Talos released detection coverage for two Microsoft Exchange Server vulnerabilities, CVE-2022-41040 (a Server Side Request Forgery flaw) and CVE-2022-41082 (which enables remote code execution when PowerShell is accessible), affecting Exchange 2013, 2016 and 2019, with limited in-the-wild exploitation reported. Microsoft issued mitigations for on-premises Exchange users on Sept. 29, 2022, with no fixes or patches available at the time, and observed exploitation led to information gathering and WebShell persistence including Antsword, SharPyShell and China Chopper.
What's compelling: The Hafnium actor used Exchange zero-days in 2021 to deliver ransomware, and Talos Incident Response ranked Exchange exploitation among the four attacks it saw most often last year - so an unpatched, internet-facing Exchange server is a proven path to initial access.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2022-41040CVE-2022-41082
- Related
- Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (Proxy NotShell) Cyber Risks ·Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole Cyber Risks ·Microsoft: Two New 0-Day Flaws in Exchange Server Cyber Risks ·