CVE-2022-41080

What it actually does

This is a Microsoft Exchange Server elevation-of-privilege vulnerability that allows a low-privileged, authenticated network attacker to abuse Exchange request handling and authorization boundaries to gain higher privileges within the Exchange application context. In real-world attacks it has been used as part of an Exchange exploitation chain, commonly with a separate remote code execution flaw, to reach Exchange PowerShell or other privileged backend functionality and execute attacker-controlled actions on the server. Successful exploitation can expose mailbox data, alter Exchange configuration, create persistence, write web shells, and support full server compromise.

Why it matters to the business

Compromise of an Exchange server can disrupt email availability, expose sensitive communications, enable phishing from trusted mail infrastructure, and provide a foothold for broader domain compromise. This issue is listed in CISA KEV, has a high EPSS score, is known to be actively exploited, and has been associated with ransomware activity, so unpatched Internet-facing Exchange servers should be treated as high-priority exposure. The CISA remediation deadline was 2023-01-31, meaning affected systems have been expected to be remediated for a long time.

How an attack unfolds

An attacker first obtains valid Exchange credentials through phishing, password reuse, credential stuffing, prior compromise, or purchase from an access broker. The attacker then sends crafted authenticated requests to exposed Exchange web endpoints such as OWA, ECP, or PowerShell-related paths. By exploiting the privilege-escalation flaw, the attacker crosses an authorization boundary and reaches functionality normally unavailable to that account. In observed attack chains, this access can be paired with Exchange remote code execution techniques to run commands under the Exchange/IIS worker process context. The attacker may then deploy a web shell, run PowerShell, dump or search mailboxes, create new mailbox rules or privileged actions, steal credentials, move laterally, and in ransomware cases stage encryption and extortion activity.

How to fix it

Apply the applicable Microsoft Exchange Server security updates immediately. Because no exact fixed version was provided in the input, update each Exchange server to a supported Cumulative Update and then install the latest available Exchange Security Update from Microsoft; November 2022 or later security updates addressed this vulnerability, but organizations should install the most current supported update level rather than only the original patch. Remove or isolate unsupported Exchange versions. If immediate patching is not possible, reduce exposure by restricting OWA, ECP, and PowerShell endpoints to trusted networks or VPN, disabling remote PowerShell for users who do not require it, enforcing MFA for administrative and mailbox access, blocking direct Internet access where feasible, and monitoring for web shell and command-execution behavior. URL rewrite mitigations used for other Exchange vulnerabilities should not be considered a substitute for patching this issue.

How to confirm the fix worked

Confirm every Exchange server is on a supported Cumulative Update and has the latest Security Update installed. Use Microsoft Exchange Health Checker and Microsoft-provided guidance to validate patch status, configuration, and known mitigation gaps. Verify that OWA, ECP, Autodiscover, and PowerShell endpoints are not unnecessarily exposed to the Internet. Review server build numbers against Microsoft Exchange release documentation. Confirm remote PowerShell is disabled for non-administrative users unless explicitly required. Validate that IIS, Exchange, and Windows event logs show no ongoing suspicious requests, web shell creation, or IIS worker process child-process execution after remediation.

Typical attack path

1. Identify an exposed Microsoft Exchange Server, often via OWA, ECP, Autodiscover, or PowerShell endpoints.
2. Obtain or reuse valid Exchange credentials for a low-privileged account.
3. Authenticate to Exchange and send crafted requests that abuse the vulnerable privilege boundary.
4. Access privileged Exchange backend functionality, frequently involving Exchange PowerShell or administrative operations.
5. Chain with code execution or post-authentication command execution techniques where available.
6. Execute commands through the IIS/Exchange worker process, often spawning PowerShell or cmd.exe.
7. Deploy persistence such as web shells, malicious scheduled tasks, mailbox rules, or additional accounts.
8. Collect mailbox data, credentials, configuration data, and internal reconnaissance information.
9. Move laterally from the Exchange server into the broader Windows environment.
10. In ransomware-motivated intrusions, stage tools, exfiltrate data, disable defenses, and deploy encryption payloads.

How to detect it

To determine whether this was already exploited, review IIS W3SVC logs, Exchange HttpProxy logs, OWA/ECP logs, Exchange Management logs, Windows Security logs, PowerShell Operational logs, Sysmon or EDR telemetry, and file-system artifacts on Exchange servers. Look for authenticated requests to OWA, ECP, Autodiscover, and PowerShell endpoints followed by unusual backend access, especially from unfamiliar IP addresses or impossible-travel locations. Hunt for IIS worker process child processes such as w3wp.exe spawning powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, bitsadmin.exe, or wget/curl-like tools. Inspect common Exchange web-accessible directories for recently created or modified .aspx files, especially under OWA auth and aspnet_client paths. Review PowerShell logs for suspicious Exchange cmdlets, encoded commands, download cradles, mailbox export activity, or commands executed under unexpected service contexts. Investigate new mailbox rules, transport rules, role assignments, delegated permissions, web shells, scheduled tasks, new local users, credential dumping tools, archive utilities, and outbound connections to unknown infrastructure. Because this vulnerability has been associated with ransomware activity, also check for mass file renaming, ransom notes, security tool tampering, backup deletion, and lateral movement from Exchange servers.

• POST /owa
• POST /ecp
• POST /powershell
• /owa/auth/
• /ecp/
• /powershell/
• cs-uri-stem=/powershell
• cs-uri-stem=/owa
• cs-uri-stem=/ecp
• cs-uri-query=*powershell*
• X-Rps-CAT
• w3wp.exe -> powershell.exe
• w3wp.exe -> cmd.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\*.aspx
• C:\inetpub\wwwroot\aspnet_client\system_web\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp\*.aspx
• New-MailboxExportRequest
• Set-Mailbox
• New-InboxRule
• New-ManagementRoleAssignment
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c whoami
• cmd.exe /c net user
• vssadmin delete shadows
• wbadmin delete catalog
• bcdedit /set {default} recoveryenabled no

What your security team should do

• Treat Internet-facing, unpatched Exchange servers as urgent incidents, not routine patching tasks, due to KEV status, active exploitation, high EPSS, and ransomware association.
• Patch all Exchange servers to the latest supported Cumulative Update and Security Update as the top priority.
• Run Microsoft Exchange Health Checker across the Exchange estate and remediate any unsupported build, missing update, or exposed endpoint findings.
• Restrict OWA, ECP, and Exchange PowerShell access to trusted networks or VPN where operationally possible.
• Disable remote PowerShell for users who do not require it and enforce MFA for administrative and remote mailbox access.
• Hunt for prior exploitation before and after patching, focusing on IIS logs, Exchange HttpProxy logs, PowerShell logs, web shell locations, and suspicious child processes from w3wp.exe.
• Search for indicators of ransomware staging, data exfiltration, credential theft, and lateral movement from Exchange servers.
• Rotate credentials for accounts used on or administered from Exchange servers if exploitation is suspected.
• Review mailbox rules, transport rules, delegated permissions, and newly created administrative assignments for malicious persistence.
• Ensure Exchange servers have EDR coverage, tamper protection, centralized logging, and recent offline backups.