{"schemaVersion":3,"id":"CVE-2022-41040","aliases":[],"status":"published","duplicateOf":null,"title":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability","description":"Microsoft Exchange Server Elevation of Privilege Vulnerability","dates":{"published":"2022-10-03T00:00:00.000Z","modified":"2025-10-21T23:15:33.946Z","reserved":null,"kevAdded":["2022-09-30T00:00:00.000Z"],"kevDue":["2022-10-21T00:00:00.000Z"]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.99956,"percentile":0.99975,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.99956},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99956,"percentile":0.99975}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99956,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.99956,"percentile":0.99975}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-09-30T00:00:00.000Z","dueDate":"2022-10-21T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability","description":"Microsoft Exchange Server allows for server-side request forgery. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.","notes":[{"type":"url","href":"https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/","label":"msrc-blog.microsoft.com/2022/…"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-41040","label":"nvd.nist.gov/vuln/detail/CVE-2022-41040"}],"vendor":"Microsoft","product":"Exchange Server","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-09-30T00:00:00.000Z","dueDate":"2022-10-21T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability","description":"Microsoft Exchange Server allows for server-side request forgery. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.","notes":[{"type":"url","href":"https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/","label":"msrc-blog.microsoft.com/2022/…"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-41040","label":"nvd.nist.gov/vuln/detail/CVE-2022-41040"}],"vendor":"Microsoft","product":"Exchange Server","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"REF_074DB840E17473D4","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_HTTP_EXCHANGE_PROXYNOTSHELL_RCE","name":"Microsoft Exchange ProxyNotShell RCE","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/http/exchange_proxynotshell_rce.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":true,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/http/exchange_proxynotshell_rce","rank":"600","rankName":"excellent","postAuth":true,"check":true,"stability":["crash-safe"],"sideEffects":["artifacts-on-disk","ioc-in-logs"],"reliability":["repeatable-session"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"}],"affected":[{"vendor":"microsoft","product":"exchange_server","name":"Exchange Server","label":"exchange_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2013:cumulative_update_23","noFixRecorded":false,"fixedIn":null},{"text":"2016:cumulative_update_22","noFixRecorded":false,"fixedIn":null},{"text":"2016:cumulative_update_23","noFixRecorded":false,"fixedIn":null},{"text":"2019:cumulative_update_11","noFixRecorded":false,"fixedIn":null},{"text":"2019:cumulative_update_12","noFixRecorded":false,"fixedIn":null}],"versionsText":"2013:cumulative_update_23 | 2016:cumulative_update_22 | 2016:cumulative_update_23 | 2019:cumulative_update_11 | 2019:cumulative_update_12","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"msexchange","label":"Microsoft Exchange","category":"server-app"}},"hubHref":"/vendor/microsoft/exchange_server"},{"vendor":"microsoft","product":"microsoft exchange server 2013 cumulative update 23","name":"Microsoft Exchange Server 2013 Cumulative Update 23","label":"microsoft exchange server 2013 cumulative update 23","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.00.0, < 15.00.1497.044","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.00.0, < 15.00.1497.044","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2013_cumulative_update_23"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 22","name":"Microsoft Exchange Server 2016 Cumulative Update 22","label":"microsoft exchange server 2016 cumulative update 22","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.0.0, < 15.01.2375.037","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.0.0, < 15.01.2375.037","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2016_cumulative_update_22"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 23","name":"Microsoft Exchange Server 2016 Cumulative Update 23","label":"microsoft exchange server 2016 cumulative update 23","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.01.0, < 15.01.2507.016","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.01.0, < 15.01.2507.016","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2016_cumulative_update_23"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 11","name":"Microsoft Exchange Server 2019 Cumulative Update 11","label":"microsoft exchange server 2019 cumulative update 11","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.02.0, < 15.02.0986.036","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.02.0, < 15.02.0986.036","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2019_cumulative_update_11"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 12","name":"Microsoft Exchange Server 2019 Cumulative Update 12","label":"microsoft exchange server 2019 cumulative update 12","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.02.0, < 15.02.1118.020","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.02.0, < 15.02.1118.020","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2019_cumulative_update_12"}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040","hostname":"msrc.microsoft.com","tags":["Vendor Advisory","Patch"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41040","label":"portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41040","hostname":"portal.msrc.microsoft.com","tags":["X Transferred","Mitigation","Patch","Vendor Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/915563","label":"www.kb.cert.org/vuls/id/915563","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Transferred","US Government Resource"]},{"url":"http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html","hostname":"packetstormsecurity.com","tags":["X Transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/","label":"www.secpod.com/blog/…","hostname":"www.secpod.com","tags":["X Transferred","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41040","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41040","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"kev-added","date":"2022-09-30T00:00:00.000Z","label":"Added to CISA KEV","detail":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability","source":"cisa"},{"kind":"published","date":"2022-10-03T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-due","date":"2022-10-21T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:15:33.946Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T02:38:46.604Z","stale":false,"partial":false}}