Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2022-41082, ProxyNotShell) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTOn-premises Microsoft Exchange Server 2013, 2016, and 2019 versions lacking the latest cumulative and security updates
Authenticated remote attackers can exploit untrusted deserialization in the Exchange PowerShell backend to execute arbitrary commands with SYSTEM privileges
Apply official Microsoft security updates immediately, or implement IIS URL Rewrite rules and restrict Remote PowerShell access as temporary workarounds
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to apply the official Microsoft Security Update (KB5019758 or later). Use the following PowerShell commands to verify your current Exchange version and apply the necessary updates.
# Check current Exchange Server version and build number
Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion
# Restart IIS and Exchange Information Store services after applying the patch
Restart-Service W3SVC, MSExchangeIS2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, apply IIS URL Rewrite rules to block malicious requests targeting the PowerShell backend and disable Remote PowerShell for non-administrative users.
# 1. Add IIS URL Rewrite rule to block ProxyNotShell exploitation vectors
Import-Module WebAdministration
$ruleName = 'Block_ProxyNotShell_PowerShell'
$filterPattern = '.*autodiscover\.json.*powershell.*'
Add-WebConfigurationProperty -pspath 'IIS:\Sites\Default Web Site' -filter 'system.webServer/rewrite/rules' -name '.' -value @{name=$ruleName; patternSyntax='Regular Expressions'; stopProcessing='True'}
Set-WebConfigurationProperty -pspath 'IIS:\Sites\Default Web Site' -filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/match" -name 'url' -value '.*'
Add-WebConfigurationProperty -pspath 'IIS:\Sites\Default Web Site' -filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/conditions" -name '.' -value @{input='{REQUEST_URI}'; matchType='Pattern'; pattern=$filterPattern}
Set-WebConfigurationProperty -pspath 'IIS:\Sites\Default Web Site' -filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/action" -name 'type' -value 'CustomResponse'
Set-WebConfigurationProperty -pspath 'IIS:\Sites\Default Web Site' -filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/action" -name 'statusCode' -value 403
# 2. Disable Remote PowerShell for non-admin users
Get-User -ResultSize Unlimited | Where-Object {$_.RemotePowerShellEnabled -eq $true} | Set-User -RemotePowerShellEnabled $false3. Log Audit & IoC Verification Commands
Run the following commands to inspect IIS logs and Windows Event logs for potential exploitation attempts.
# Search IIS logs for ProxyNotShell request patterns
$LogPath = 'C:\inetpub\logs\LogFiles\W3SVC1\*.log'
Select-String -Path $LogPath -Pattern 'autodiscover.json' | Where-Object { $_ -like '*powershell*' }
# Check Application Event Logs for suspicious deserialization errors
Get-WinEvent -LogName 'Application' | Where-Object { $_.Message -like '*System.Runtime.Serialization*' -and $_.Message -like '*Exchange*' } | Select-Object -First 10 | Format-Table TimeCreated, Message -WrapBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
CVE-2022-41082 is a critical deserialization of untrusted data vulnerability (CWE-502) residing in the Remote PowerShell backend of Microsoft Exchange Server. The root cause lies in the server's failure to properly validate and sanitize serialized .NET objects transmitted via WS-Management (Web Services-Management) sessions. An authenticated attacker with access to the PowerShell endpoint can trigger this vulnerability to execute arbitrary code in the context of the local SYSTEM account.
2. Exploitation Mechanics & Attack Scenario
In a typical attack scenario (often chained with CVE-2022-41040 as 'ProxyNotShell'), the attacker bypasses frontend access controls or authenticates as a standard user to reach the Exchange backend PowerShell endpoint ('/powershell'). Once a remote PowerShell session is established, the attacker transmits a specially crafted payload containing serialized .NET gadgets. When the Exchange server deserializes this payload, it triggers the execution of embedded system commands, allowing the attacker to deploy web shells or execute arbitrary binaries.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, with an EPSS score of 0.9997. Successful exploitation grants the attacker full administrative control over the compromised Exchange server. This can lead to lateral movement across the Active Directory domain, complete compromise of corporate email communications, deployment of ransomware, and severe operational disruption.
Official Vendor Advisories & References
Microsoft Exchange Server Remote Code Execution Vulnerability
Frequently Asked SecOps Questions (CVE-2022-41082)
FAQQ1. How critical is CVE-2022-41082 and is it actively exploited in the wild?
CVE-2022-41082 is rated CVSS 8.0 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-41082?
Primary impacted vendors include microsoft across exchange_server. Scope summary: On-premises Microsoft Exchange Server 2013, 2016, and 2019 (Systems without KB5019758 or later)
Q3. What temporary mitigations or workarounds exist for CVE-2022-41082 before patching?
[Mitigation] Apply official Microsoft security updates immediately, or implement IIS URL Rewrite rules and restrict Remote PowerShell access as temporary workarounds Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-41082
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-58644, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-50522, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft SharePoint Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-45659, CWE-502)
[Affected Scope] Microsoft SharePoint Server deployments
Microsoft Office SharePoint Missing Authentication Privilege Escalation Vulnerability (CVE-2026-56164) Security Advisory
[Affected Scope] Microsoft Office SharePoint Server environments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.