New 0-Day Vulnerabilities Found in Microsoft Exchange | Huntress

Huntress investigated reports of new Microsoft Exchange zero-day vulnerabilities—an authenticated SSRF (CVE-2022-41040) and a chained post-auth Remote Code Execution (CVE-2022-41082) enabling PowerShell execution and webshell deployment; Microsoft confirmed the issues, community researchers reported active backdoors on many servers, and confirmed webshell paths and Defender detections are provided alongside containment guidance.