CVE-2022-41040

High (8.8) in Microsoft Exchange Server. In CISA KEV since 2022-09-30, with known ransomware use. EPSS 100% chance of exploitation in the next 30 days.

EPSS

100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-11-01)

CISA KEV

listed 2022-09-30, due 2022-10-21, known ransomware use

CWE

CWE-918

Published

2022-10-03

Modified

2026-06-17

Record from

the NVD, synced 2026-10-19

Affected

• microsoft:exchange_server

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040
• http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41040
• https://www.kb.cert.org/vuls/id/915563
• https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/

Check your stackJSON