Vulnerabilitycritical
How an unpatched Microsoft Exchange 0-day likely caused one of the UK’s biggest hacks ever
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-41080 | Microsoft Exchange Server Privilege Escalation Exploited in Ransomware Campaigns | 8.8 | 77% | KEVRansomware | KEV |
| CVE-2022-41082 | Authenticated RCE in Microsoft Exchange Server (ProxyNotShell) | 8.0 | 100% | KEVRansomwarePoC | KEV |
From the original article
2 min read at arstechnica.com
“At the time Microsoft released temporary mitigations rather than a security patch—it took until November 2022 for a security update to appear to fully resolve the problem,” the researcher wrote. “This was a significant delay. In the meantime, the security mitigations Microsoft provided were repeatedly bypassed.”
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.