CVE-2022-41040

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 3, 2026 14 articles

VulnLookup ↗ NVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

94.22%

probability

This CVE has a 94.22% probability of being exploited in the next 30 days.

0% Top 99.9th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Description

Project Zero

Server-side request forgery

Attack Intelligence

CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy') CWE-610 · Externally Controlled Reference to a Resource in Another Sphere CWE-664 · Improper Control of a Resource Through its Lifetime CWE-918 · Server-Side Request Forgery

Google Project Zero

Patched

Nov. 8, 2022

Reported by

DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC working with Trend Micro Zero Day Initiative

Root Cause Analysis

???

Exploits & PoC

kljunowsky/CVE-2022-41040-POC

CVE-2022-41040 - Server Side Request Forgery (SSRF) in Microsoft Exchange Server

TaroballzChen/CVE-2022-41040-metasploit-ProxyNotShell

the metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated at

r3dcl1ff/CVE-2022-41040

mitigation script for MS Exchange server vuln

d3duct1v/CVE-2022-41040

Code set relating to CVE-2022-41040

rjsudlow/proxynotshell-IOC-Checker

Script to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)

ITPATJIDR/CVE-2022-41040

PoC CVE-2022-41040 — ITPATJIDR/CVE-2022-41040

0-Gram/CVE-2022-41040

PoC CVE-2022-41040 — 0-Gram/CVE-2022-41040

CentarisCyber/CVE-2022-41040_Mitigation

PoC CVE-2022-41040 — CentarisCyber/CVE-2022-41040_Mitigation

8 repos — triés par ⭐ Rechercher sur GitHub ↗

Microsoft confirms new Exchange zero-days are used in attacks

BleepingComputer Sep 30, 2022

Microsoft fixes ProxyNotShell Exchange zero-days exploited in attacks

BleepingComputer Nov 08, 2022

October 2022 Patch Tuesday | Microsoft Releases 84 Vulnerabilities With 13 Critical, Plus 12 Microsoft Edge (Chromium-Based); Adobe Releases 4 Advisories, 29 Vulnerabilities With 17 Critical.

Qualys Oct 11, 2022

November 2022 Patch Tuesday | Microsoft Releases 65 New Vulnerabilities With 10 Critical; Adobe Releases Zero Advisories (for the First Time in Six Years).

Qualys Nov 08, 2022

Defense Lessons From the Black Basta Ransomware Playbook

Qualys Feb 25, 2025

Security Advisory 2022-079

CERT-EU Nov 09, 2022

Microsoft Confirms 2 New Exchange Zero-Day Flaws Being Used in the Wild

TheHackerNews

Microsoft Exchange servers hacked to deploy LockBit ransomware

BleepingComputer Oct 11, 2022

Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub

BleepingComputer Oct 03, 2022

Qualys Research Team: Threat Thursdays, October 2022

Qualys Oct 28, 2022

Qualys Response to ProxyNotShell Microsoft Exchange Server Zero-Day Threat Using Qualys Cloud Platform

Qualys Sep 30, 2022

State-Sponsored Hackers Likely Exploited MS Exchange 0-Days Against ~10 Organizations

TheHackerNews

Microsoft updates mitigation for ProxyNotShell Exchange zero days

BleepingComputer Oct 05, 2022

Microsoft Exchange server zero-day mitigation can be bypassed

BleepingComputer Oct 03, 2022

Signal Intelligence

Confidenceⓘ

82%

EPSS 94.22%

Mentions 14

Last Seen Feb 25, 2025

CNA Information

Analyst Note

CVE-2022-41040 is confirmed as an elevation of privilege vulnerability in Microsoft Exchange Server with a high CVSS score of 8.8, inclusion in Google Project Zero research, and documentation in CERT-EU security advisories indicating active exploitation. The evidence strongly supports the confirmed status, though the single article and absence from CISA KEV list warrant a slightly conservative confidence level.