Microsoft says that it is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019. The first one, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, and the second one, identified as CVE-2022-41082, allows Remote Code Execution (RCE) when PowerShell is accessible to the attacker.
Microsoft reports that it is aware of limited targeted attacks using these two vulnerabilities. In these attacks, CVE-2022-41040 can enable an authenticated attacker to remotely trigger CVE-2022-41082. It should be noted, says Microsoft, that authenticated access to the vulnerable Exchange Server is necessary to successfully exploit either vulnerability.
While the company says that it is working on an accelerated timeline to release a fix, until then mitigations and detections guidance can be found here.
Exchange Online customers do not need to take any action says Microsoft.
