CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2022-41082, ProxyNotShell) Technical Advisory
[Affected Scope] On-premises Microsoft Exchange Server 2013, 2016, and 2019 versions lacking the latest cumulative and security updates
[Impact] Authenticated remote attackers can exploit untrusted deserialization in the Exchange PowerShell backend to execute arbitrary commands with SYSTEM privileges
[Mitigation] Apply official Microsoft security updates immediately, or implement IIS URL Rewrite rules and restrict Remote PowerShell access as temporary workarounds
Microsoft Exchange Server Elevation of Privilege and SSRF Vulnerability (CVE-2022-41040, ProxyNotShell) Security Advisory
[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019 On-Premises environments
[Impact] Authenticated attackers can exploit this SSRF vulnerability to access backend APIs, leading to Remote Code Execution (RCE) and complete system compromise
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or implement IIS URL Rewrite rules as a temporary workaround