CVE-2022-41040

Microsoft Exchange Server Elevation of Privilege Vulnerability

Exploited in the wild: Yesadded 2022-09-30 · due 2022-10-21 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

1 known · links only

Microsoft Exchange ProxyNotShell RCE ↗
This module chains two vulnerabilities on Microsoft Exchange Server that, when combined, allow an authenticated attacker to interact with the Exchange Powershell backend (CVE-2022-41040), where a deserialization flaw can be leveraged to obtain code execution (CVE-2022-41082). This exploit only support Exchange Server 2019. These vulnerabilities were patched in November 2022.
ruby · seen 2026-10-18

0 dispatches

No dispatch on our wire has named this CVE yet.

SaintBear
1. “Cadet Blizzard is also known for exploiting Confluence servers through the CVE-2021-26084 vulnerability, Exchange servers through multiple vulnerabilities including CVE-2022-41040 and ProxyShell”
  cited as exploiting · source: microsoft.com ↗ · 2026-10-17
2. “Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

KEV additions reach Telegram and the KEV-only RSS as they land.

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.