Microsoft Exchange Zero-Day Vulnerabilities

Microsoft Exchange Zero-Day Vulnerabilities

Product Serial: F-2022-09-30a

TLP:CLEAR

In this flash report, ZeroFox Intelligence shares details about two on-premise Microsoft Exchange zero-day vulnerabilities actively being exploited in the wild.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:00 AM (EDT) on September 30, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

On September 29, 2022, Microsoft confirmed two zero-day vulnerabilities–tracked as CVE-2022-41040 and CVE-2022-41082–affecting its Exchange Server, versions 2013, 2016, and 2019. Multiple sources disclosed the vulnerabilities, and state that the vulnerabilities are being actively exploited in the wild. While Microsoft has advised that only on-premises Exchange customers are impacted and that customers with Exchange Online do not need to take any action, customers that operate a hybrid server could be impacted.

Key Findings

• Two zero-day vulnerabilities were identified that affect Microsoft Exchange Server versions 2013, 2016, and 2019. On-premises Exchange customers are impacted, and possibly those operating hybrid server environments as well.
• Active exploitation in the wild has been identified.
• Workarounds are available, and Microsoft encourages users to enact URL rewrite instructions and block exposed Remote PowerShell ports.