Microsoft Exchange On-Prem Zero-Day Vulnerabilities Exploited

GTSC and Microsoft disclosed two on‑premises Microsoft Exchange zero‑day vulnerabilities—CVE-2022-41040 (SSRF) and CVE-2022-41082 (post-auth RCE)—affecting Exchange Server 2013/2016/2019 (Exchange Online not affected). No patches were available at the time; Microsoft is investigating and provided mitigations including an IIS URL rewrite, blocking Remote PowerShell ports (5985/5986), and restricting external access to Exchange servers. The report notes exploitation requires prior authentication and exposed PowerShell Remoting, reducing but not eliminating risk compared to prior Exchange zero-days.