CVE-2022-41040 KEVRansomwarePublic exploit High · 8.8 EPSS >99.9%

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

Microsoft · Exchange Server

Summary

Microsoft Exchange Server contains a server-side request forgery flaw that lets an attacker make the server issue requests it should not. An attacker with network access and low-privilege authenticated credentials, requiring no user interaction, can exploit it to cause the Exchange Server to send crafted requests on their behalf.

Official description · NVD

Microsoft Exchange Server Elevation of Privilege Vulnerability

Breakdown

83.0 / 100

Exploited: Yes, in CISA KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Gain administrator or root rightsT1068 · Exploitation for Privilege EscalationAI-written (claude-haiku-5-5)Medium confidence31 general detection rules

First seen exploited 4 days before it was disclosed. Public exploit code (Metasploit) was available 5 days before disclosure.

Public exploit codeMetasploit28 Sep 20225 days before
First seen exploitedVulnCheck KEV evidence29 Sep 20224 days before
Added to CISA KEVknown ransomware use; EU database agrees30 Sep 20223 days before
Disclosed3 Oct 2022day 0
Named in a threat reportmicrosoft.com14 Jun 2023+8 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Network-exploitable public-facing Exchange server, low privileges

Microsoft Exchange Server Elevation of Privilege Vulnerability

From the official description (NVD) Original ↗

Privilege EscalationTA0004

Exploitation for Privilege Escalation T1068 Medium

AI mapping from the description · primary impact

Vulnerability yields privilege escalation on the server

Microsoft Exchange Server Elevation of Privilege Vulnerability

From the official description (NVD) Original ↗

Detection

0 rules for this CVE · 180 general rules for its techniques

Rules for this CVE

0 that reference CVE-2022-41040 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Exploitation for Privilege EscalationT106831 general rules

Exploiting CVE-2019-1388criticalstable
Audit CVE Eventcriticaltest
HackTool - SysmonEOP Executioncriticaltest
InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
Possible Coin Miner CPU Priority Paramcriticaltest
Potential CVE-2021-41379 Exploitation Attemptcriticaltest
Potential SystemNightmare Exploitation Attemptcriticaltest
Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest

All 31 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportMicrosoftJun 2023

Reports are matched by finding the exact id CVE-2022-41040 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Microsoft14 Jun 2023

Cadet Blizzard emerges as a novel and distinct Russian threat actor

Cadet Blizzard is also known for exploiting Confluence servers through the CVE-2021-26084 vulnerability, Exchange servers through multiple vulnerabilities including CVE-2022-41040 and ProxyShell, and likely commodity vulnerabilities in various open-source platforms such as content management systems.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

6 links, grouped by NVD tag

Exploitation evidence

Exploited in the wild

Listed since 30 Sep 2022. Federal due date 21 Oct 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 30 Sep 2022. EUVD-2022-44285

Public exploitAdvisories link exploit code.

, 30 Oct 2026

>99.9%Top 0.02%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.98%).

3.1

8.8High · 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 1493 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9998 20.0/20

Threat reports1 report 3.9/10

Public exploit code1 NVD reference tagged Exploit; 7 PoC-in-GitHub repos; 1 Metasploit module 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 8.8 6.2/7

End-of-life productsupported or unknown 0.0

Total83.0

Record

Published: 3 Oct 2022
Modified: 17 Jun 2026
: CWE-918 Server-Side Request Forgery
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

Privilege EscalationTA0004

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Cadet Blizzard emerges as a novel and distinct Russian threat actor

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 2

US Government Resource 2

Third Party Advisory 2

How attackers get in

What they do

techniques