Microsoft has officially disclosed that they are investigating two zero-day security vulnerabilities impacting Exchange Server 2013, 2016, and 2019 following reports of in-the-wild exploitation.

#The_vulnerability:
1. CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability.
2. CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker.
#Mitigations:
On-premises Microsoft Exchange customers are advised to add a blocking rule in IIS Manager & to disable remote PowerShell access for non-admin users as a temporary workaround to mitigate potential threats

#References:
https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
#cyberdome #MicrosoftExchange #cyberthreats #cybersecurity