Live › vulnerability › CVE-2022-41040
Go to dashboardMicrosoft Exchange Server has a server-side request forgery flaw, dubbed ProxyNotShell, that lets a remote attacker make the server send requests to internal systems. It is chainable with CVE-2022-41082, which allows remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Exchange Server | vendor | – | – |
| microsoft exchange server | vendor | = 2013 | – |
| microsoft exchange server | vendor | = 2016 | – |
| microsoft exchange server | vendor | = 2019 | – |
Unknown from the sources.
Apply the Microsoft Exchange Server updates per vendor instructions (version not stated in sources).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2022-41040")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.