CVE-2022-41082: Microsoft Exchange Server deserialization flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed ransomware use, has a near-maximum EPSS score, and allows remote code execution on a widely deployed mail server.

What it is

CVE-2022-41082 is a remote code execution vulnerability in Microsoft Exchange Server caused by deserialization of untrusted data (CWE-502). It is part of the ProxyNotShell chain and is listed in CISA's Known Exploited Vulnerabilities catalog, so it matters to any organization running on-premises Exchange.

Impact

An attacker who can reach the vulnerable endpoint can execute arbitrary code on the Exchange server, gaining full control of the host and its mail data. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The CVSS vector is AV:A/PR:L/UI:N, meaning the attack is adjacent-network based, requires low privileges, and needs no user interaction. In practice this is reached over the network by an authenticated low-privileged user, consistent with the ProxyNotShell chain where a separate authentication bypass is used first.

Exploitation

CISA added it to the KEV catalog on 2022-09-30 with a 2022-10-21 remediation due date and flags known ransomware campaign use, and EPSS gives a 30-day probability of 0.9997. A public exploit reference exists (Packet Storm, tagged Exploit), and the Play ransomware group is documented as using it.

What to do

• Apply the Microsoft Exchange security updates referenced in the vendor advisory and MSRC update guide immediately.
• If patching cannot be completed at once, apply the vendor-provided mitigation (URL rewrite rule blocking the vulnerable endpoint) as a temporary measure.
• Restrict network access to Exchange endpoints, especially OWA/ECP, to trusted networks and block direct internet exposure where possible.
• Enforce least privilege on Exchange service and user accounts to limit what a low-privileged attacker can reach.
• Monitor for and remove web shells or other persistence left by prior exploitation after patching.

Detection

• Hunt Exchange and IIS logs for requests to the vulnerable autodiscover/OWA endpoint patterns associated with ProxyNotShell exploitation.
• Monitor for child processes spawned by w3wp.exe (Exchange worker process), which is abnormal and indicates code execution.
• Look for newly written .aspx or other web shell files in Exchange web directories.
• Alert on authentication events from low-privileged accounts followed by unusual server-side process creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.