CVE-2022-41080: Microsoft Exchange Server elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityIt is in CISA KEV with known ransomware use, has a very high EPSS score, and allows low-privileged network attackers to fully compromise an Exchange server.

What it is

CVE-2022-41080 is an elevation of privilege vulnerability in Microsoft Exchange Server. A network-reachable attacker with low privileges can exploit it to gain high-level control over confidentiality, integrity and availability of the affected server. Because Exchange is a high-value target and this flaw is listed in CISA's Known Exploited Vulnerabilities catalog, it warrants prompt patching.

Impact

An attacker who already holds a low-privileged account can escalate to full control of the Exchange server, exposing mail data and enabling further compromise of the host.

Attack surface

Reachable over the network with a low-privileged authenticated account; no user interaction is required per the CVSS vector (AV:N/AC:L/PR:L/UI:N).

Exploitation

CISA added it to the KEV catalog on 2023-01-10 with a 2023-01-31 remediation due date and flags known ransomware campaign use; EPSS gives a 30-day exploitation probability of 0.773 (99.5th percentile).

What to do

• Apply the Microsoft Exchange Server security update referenced in the MSRC advisory as soon as possible.
• Prioritize internet-facing Exchange servers and any with OWA/ECP exposed.
• Restrict and monitor privileged Exchange accounts and administrative interfaces.
• Verify patch level against the MSRC update guide and re-check after any rollback.

Detection

• Monitor Exchange and Windows event logs for anomalous privilege escalation or new administrative role assignments.
• Alert on unusual access to Exchange administrative endpoints (ECP/OWA) from low-privileged accounts.
• Hunt for post-exploitation activity consistent with ransomware staging on Exchange hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.