CVE-2022-41040

Think of Microsoft Exchange Server as the “front desk” that handles email for your company. This vulnerability is a weakness that can let an attacker walk past normal entry points and take control as a more powerful user inside the Exchange system. Once they have that level of control, they can enable further attacks, including ransomware activity.

This matters if you run Microsoft Exchange Server using one of the affected cumulative update levels (Exchange 2013 CU23, Exchange 2016 CU22 or CU23, or Exchange 2019 CU11 or CU12). Because the flaw can be reached over the network and does not require user interaction, it can be especially dangerous for servers exposed to the internet or reachable from the outside. Treat this as a real risk for any deployment where the vulnerable Exchange instance is reachable from an attacker.

This is RED because CISA has confirmed real-world exploitation in ransomware campaigns, and Microsoft Exchange-related incident reporting shows attackers using this family of techniques to deploy follow-on payloads. You should act immediately by applying the vendor-fixed cumulative updates for your Exchange branch—there is no “wait and see” option here.