CVE-2022-41080

Think of Microsoft Exchange Server as the “mail hub” your business uses to send and receive email. This vulnerability is like a way for an attacker to raise their privileges inside that mail hub—enough to do much more damage than a simple login attempt. Since it’s been used in real ransomware campaigns, keeping it unpatched materially increases your risk of a serious incident.

This matters to you if you run Microsoft Exchange Server on-premises (including the specific Exchange 2013/2016/2019 cumulative updates listed in this finding set). It becomes a risk when your Exchange system is reachable in a way that an attacker can attempt the vulnerable behavior—especially because it has been observed being used in ransomware activity. Because this is an elevation-of-privilege issue, successful attackers can potentially move from limited access to higher control.

This is RED because it’s confirmed to be exploited in real-world ransomware campaigns and appears in CISA’s Known Exploited Vulnerabilities list. The key action is to apply the vendor updates immediately—waiting increases the chance an attacker can gain higher privileges during an attempted intrusion.

1. Confirm whether you are affected

   • Identify your exact Microsoft Exchange Server version and cumulative update level.
   • Compare it to the affected CU/build lines referenced in Microsoft’s fix list for CVE-2022-41080.

2. Find the correct fixed version for your branch

   • Exchange Server 2013 Cumulative Update 23 → fixed in 15.00.1497.044
   • Exchange Server 2016 Cumulative Update 22 → fixed in 15.01.2375.037
   • Exchange Server 2016 Cumulative Update 23 → fixed in 15.01.2507.016
   • Exchange Server 2019 Cumulative Update 11 → fixed in 15.02.0986.036
   • Exchange Server 2019 Cumulative Update 12 → fixed in 15.02.1118.020

3. Upgrade following Microsoft’s official guidance

   • Use Microsoft’s update guidance page for CVE-2022-41080 to download and apply the correct Exchange update for your specific CU line.
   • Plan for a maintenance window because Exchange updates require controlled service operations.

4. Validate after patching

   • Verify the Exchange server now reports the fixed build numbers listed above.
   • Confirm Exchange services are functioning normally.

5. If patching is delayed (temporary containment)

   • The findings don’t provide a specific safe workaround. In practice, focus on reducing exposure while you prepare the patch: limit access paths to Exchange to only what is required for your business and ensure your perimeter and remote access configurations are locked down.
   • Treat this as a time-critical gap—KEV indicates active attackers are using the flaw in the wild.

6. What to monitor

   • Review Exchange-related logs and security alerts for signs of suspicious privilege changes or post-exploitation behavior after the update window and continuously as part of your incident detection process.

CVE-2022-41080 is an elevation-of-privilege vulnerability affecting Microsoft Exchange Server. It is listed in the CISA Known Exploited Vulnerabilities catalog, with remediation due date 2023-01-31T00:00:00Z, and is noted as being used in ransomware campaigns. The findings do not list public exploit code availability, but KEV placement is treated as confirmation of real-world exploitation activity. This is why the practical risk for operators is high: attackers can leverage the vulnerable Exchange behavior to increase privileges and then proceed with ransomware or other malicious actions. (No KEV-versus-EPSS conflict occurs here: exploitation confirmation via KEV outweighs prediction metrics.)