Microsoft confirms two Exchange Server zero days are being used in cyberattacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2022-41040+1 related CVE | Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell) | 8.8 group max | 100% | KEVRansomwarePoC | KEV |
From the original article
3 min read at therecord.media
Microsoft confirmed it is investigating two zero days affecting its Exchange Server software late Thursday following a report from Vietnamese cybersecurity firm GTSC that the vulnerabilities are being exploited in the wild. GTSC said it discovered the issues in August while doing security incident monitoring and response, then reported the issue to Microsoft’s Zero Day Initiative, which confirmed the bugs.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.