CVE-2022-41082 KEVRansomwarePublic exploit High · 8.0 EPSS >99.9%
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange Server
Summary
Microsoft Exchange Server contains a remote code execution flaw rooted in deserialization of untrusted data. The affected component is not specified beyond the product itself. An attacker with low-privileged authenticated access on an adjacent network can execute code on the server, with no user interaction required. Exploitation requires that the attacker can reach the target over the adjacent network segment and hold a low-privilege account.
Heading is the official description · NVD
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
78.6 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 7/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What can follow
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 4 days before it was disclosed. Public exploit code (Metasploit) was available 5 days before disclosure.
- Public exploit codeMetasploit5 days before
- First seen exploitedVulnCheck KEV evidence4 days before
- Added to CISA KEVknown ransomware use; EU database agrees3 days before
- Disclosedday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
6 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 6Initial AccessTA0001
Valid Accounts T1078 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details. also Persistence, Privilege Escalation, Stealth
MITRE CTID mapping of the KEV entry · how it is exploited
This vulnerability is exploited by a remote adversary who has either authenticated to a Microsoft Exchange Server or has gained access to PowerShell prior to leveraging this vulnerability. The adversary then performs remote code execution via PowerShell to install a Chopper web shell to perform Active Directory reconnaissance and data exfiltration.
ExecutionTA0002
PowerShell T1059.001 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · how it is exploited
PersistenceTA0003
Web Shell T1505.003 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
DiscoveryTA0007
Account Discovery T1087 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
Domain Trust Discovery T1482 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
ExfiltrationTA0010
Exfiltration Over Web Service T1567 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
Detection
0 rules for this CVE · 358 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2022-41082 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Valid AccountsT107856 general rules
- Win Susp Computer Name Containing Samtheadmincriticaltest
- Account Created And Deleted Within A Close Time Framehightest
- Activity From Anonymous IP Addresshightest
- Atypical Travelhightest
- Azure AD Threat Intelligencehightest
- Azure Subscription Permission Elevation Via AuditLogshightest
- External Remote SMB Logon from Public IPhightest
- Impossible Travelhightest
PowerShellT1059.001222 general rules
- Bad Opsec Powershell Code Artifactscriticaltest
- Greenbug Espionage Group Indicatorscriticaltest
- Rorschach Ransomware Execution Activitycriticaltest
- Silence.EDA Detectioncriticaltest
- Turla Group Commands May 2020criticaltest
- UNC2452 PowerShell Patterncriticaltest
- HackTool - CrackMapExec Execution Patternshighstable
- Potential Emotet Activityhighstable
Web ShellT1505.00335 general rules
- Certificate Request Export to Exchange Webservercriticaltest
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
- Mailbox Export to Exchange Webservercriticaltest
- Oracle WebLogic Exploitcriticaltest
- Solarwinds SUPERNOVA Webshell Accesscriticaltest
- Webshell Remote Command Executioncriticaltest
- WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
- Antivirus - Web Shell Detection Signaturehightest
Account DiscoveryT108716 general rules
- Chopper Webshell Process Patternhightest
- HackTool - SOAPHound Executionhightest
- HackTool - winPEAS Executionhightest
- Hacktool Rulerhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- Network Reconnaissance Activityhightest
Domain Trust DiscoveryT148217 general rules
- BloodHound Collection Fileshightest
- HackTool - Bloodhound/Sharphound Executionhightest
- HackTool - SharpView Executionhightest
- HackTool - TruffleSnout Executionhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- PUA - AdFind Suspicious Executionhightest
Exfiltration Over Web ServiceT156712 general rules
- Monero Crypto Coin Mining Pool Lookuphighstable
- Communication To Ngrok Tunneling Service - Linuxhightest
- Communication To Ngrok Tunneling Service Initiatedhightest
- Process Initiated Network Connection To Ngrok Domainhightest
- Arbitrary File Download Via ConfigSecurityPolicy.EXEmediumtest
- LOLBAS Data Exfiltration by DataSvcUtil.exemediumtest
- Network Connection Initiated To BTunnels Domainsmediumtest
- Network Connection Initiated To Cloudflared Tunnels Domainsmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX