VulnerabilitycriticalExploited in the wild

Microsoft Patches Six Zero

Infosecurity Magazineby Phil MuncasterNov 9, 2022 · 09:30 UTC (Nov 9, 2022)1 min read3

Read at infosecurity-magazine.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-41040 CVE-2022-41082 CVE-2022-41128 CVE-2022-41073 CVE-2022-41125 CVE-2022-41091 CVE-2022-41080

Tags: cve-2022-41040 cve-2022-41082 cve-2022-41128 cve-2022-41073 cve-2022-41125 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2022-41040 +1 related CVE CVE-2022-41082	Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell)	8.8 group max	100%	KEVRansomwarePoC	Oct 3, 2022 KEV Sep 30, 2022
CVE-2022-41128 +3 related CVEs CVE-2022-41125 CVE-2022-41073 CVE-2022-41091	Out-of-bounds Write RCE in Microsoft Windows JScript9 Scripting Engine	8.8 group max	25%	KEV	Nov 9, 2022 KEV Nov 8, 2022
CVE-2022-41080	Microsoft Exchange Server Privilege Escalation Exploited in Ransomware Campaigns	8.8	77%	KEVRansomware	Nov 9, 2022 KEV Jan 10, 2023

From the original article

1 min read at infosecurity-magazine.com

Microsoft released a relatively low number of security updates on Patch Tuesday yesterday, but six of the CVEs are being actively exploited in the wild. Among these are the so-called “ProxyNotShell” bugs in Microsoft Exchange Server first revealed in September.

Infosecurity Magazine

By Phil Muncaster · infosecurity-magazine.com

Read the full article at Infosecurity Magazine

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.