CVE-2022-41040

Exploited in the wild. In CISA KEV since 2022‑09‑30. A vendor fix is available.

CVSS 3.18.8High EPSS percentile99th100% chance in 30 days CISA KEVListedsince 2022-09-30, due 2022-10-21
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2022-10-03Updated 2025-10-30Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft Exchange Server versions/cumulative updates you are running (especially 2013 CU23, 2016 CU22/CU23, and 2019 CU11/CU12).
If you match an affected version, upgrade to the fixed update: Exchange 2013 CU23 → 15.00.1497.044.
If you match an affected version, upgrade to the fixed update: Exchange 2016 CU22 → 15.01.2375.037 and Exchange 2016 CU23 → 15.01.2507.016.
If you match an affected version, upgrade to the fixed update: Exchange 2019 CU11 → 15.02.0986.036 and Exchange 2019 CU12 → 15.02.1118.020.
If patching must be delayed, follow Microsoft’s official compensating measures/workarounds for CVE-2022-41040 in the linked vendor advisory.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Microsoft Exchange Server Elevation of Privilege Vulnerability

In plain language

Written by AI from the record

CVE-2022-41040 is a Microsoft Exchange Server security bug that lets attackers gain high-level privileges over your email server over the network, with little attacker effort—so any small business running affected Exchange versions should treat this as urgent and apply the fixed updates.

CVE-2022-41040 is a network-accessible elevation of privilege in Microsoft Exchange Server (CWE-918) that allows an attacker to act with more privileged permissions; CISA lists it as exploited in ransomware campaigns with a required remediation deadline of 2022-10-21.

If you're affected

Full email system takeover
Ransomware deployment risk
Account and mailbox compromise
Service disruption

What is it

Think of Microsoft Exchange Server as the “front desk” that handles email for your company. This vulnerability is a weakness that can let an attacker walk past normal entry points and take control as a more powerful user inside the Exchange system. Once they have that level of control, they can enable further attacks, including ransomware activity.

Who is affected

This matters if you run Microsoft Exchange Server using one of the affected cumulative update levels (Exchange 2013 CU23, Exchange 2016 CU22 or CU23, or Exchange 2019 CU11 or CU12). Because the flaw can be reached over the network and does not require user interaction, it can be especially dangerous for servers exposed to the internet or reachable from the outside. Treat this as a real risk for any deployment where the vulnerable Exchange instance is reachable from an attacker.

How urgent is it

This is RED because CISA has confirmed real-world exploitation in ransomware campaigns, and Microsoft Exchange-related incident reporting shows attackers using this family of techniques to deploy follow-on payloads. You should act immediately by applying the vendor-fixed cumulative updates for your Exchange branch—there is no “wait and see” option here.

What to do — in detail

Confirm whether you’re affected

Identify your exact Microsoft Exchange Server version and cumulative update level (for example: Exchange 2013 CU23, Exchange 2016 CU22/CU23, or Exchange 2019 CU11/CU12).
Compare against the affected list:
- Microsoft Exchange Server 2013 Cumulative Update 23
- Microsoft Exchange Server 2016 Cumulative Update 22 and Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 11 and Cumulative Update 12

Apply the fixed update (do this first)

Upgrade to the fixed cumulative update for your branch:

Exchange 2013 Cumulative Update 23 → fixed in 15.00.1497.044
Exchange 2016 Cumulative Update 22 → fixed in 15.01.2375.037
Exchange 2016 Cumulative Update 23 → fixed in 15.01.2507.016
Exchange 2019 Cumulative Update 11 → fixed in 15.02.0986.036
Exchange 2019 Cumulative Update 12 → fixed in 15.02.1118.020

If patching is delayed

Apply Microsoft’s official compensating measures/workarounds for CVE-2022-41040 from the Microsoft advisory pages:
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41040
In parallel, reduce exposure: ensure the vulnerable Exchange instance is not unnecessarily reachable from the internet (network controls). (Only take this step if it doesn’t break business-critical access.)

Targeting / operational notes

Plan the upgrade during a maintenance window where possible, and verify Exchange services after update completion.
If you run multiple Exchange servers or load-balanced roles, make sure the patch level is consistent across them.

Monitoring after the fix

Monitor Exchange and Windows logs for suspicious authentication/authorization anomalies and unusual web/app activity tied to Exchange.
Review whether any follow-on tools may have been introduced (because public exploitation and real-world campaigns are reported). If you find indicators of compromise, isolate affected hosts and engage incident response.

Due date note from CISA

CISA remediation due date was 2022-10-21 for this issue; the expectation is that affected environments are already remediated.

Technical context

Severity is high (CVSS 8.8) and the weakness is CWE-918 (Server-Side Elevation of Privilege). Findings indicate a network attack vector, low authentication requirements, and no user interaction. CISA lists CVE-2022-41040 in the KEV catalog (added 2022-09-30) with a remediation due date of 2022-10-21, and CISA-required action is to apply vendor updates. News reporting indicates real-world exploitation: SharkLoader has been used to deploy Cobalt Strike Beacon via exploitation of internet-facing applications, including Microsoft Exchange. Public exploitation exists (at least one known public exploit), which increases practical risk. The EPSS prediction is extremely high, but the vulnerability is treated as actively exploited due to CISA KEV inclusion and exploitation reporting.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2022-09-30.

US federal agencies must remediate by 2022-10-21.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

100% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 127 days before any public exploit.

2026-06-25OpenVAS check added
2026-03-06Public exploit / PoCsource: packetstormnuclei check added
2025-10-30Patch availableworkaround available, record updated
2022-10-03Publishedweakness classified, att&ck mapped
2022-09-30Added to CISA KEVransomware campaign

Affected products

Microsoft Corpcommercial · USaka Microsoft, microsoft corporation

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable