IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek KEV Fidye yazılımında kullanılıyor

CVE-2022-41080Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2013 Cumulative Update 23; Microsoft Microsoft Exchange Server 2016 Cumulative Update 22; Microsoft Microsoft Exchange Serv… Yayım: (3 yıl önce)

Aktif olarak istismar ediliyor — Microsoft Exchange Server Privilege Escalation Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 10.01.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 31.01.2023.

Gerekli işlem: Apply updates per vendor instructions. https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080; https://nvd.nist.gov/vuln/detail/CVE-2022-41080

Açıklama

Microsoft Exchange Server Elevation of Privilege Vulnerability

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
microsoft exchange server 15.01.0 – < 15.01.2507.016
Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 15.00.0 – < 15.00.1497.044
Microsoft Microsoft Exchange Server 2016 Cumulative Update 22 15.0.0 – < 15.01.2375.037
Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 15.01.0 – < 15.01.2507.016
Microsoft Microsoft Exchange Server 2019 Cumulative Update 11 15.02.0 – < 15.02.0986.036
Microsoft Microsoft Exchange Server 2019 Cumulative Update 12 15.02.0 – < 15.02.1118.020

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (5)
  • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*

Aynı üründe son açıklar — Microsoft Exchange Server

9.3Kritik
CVE-2026-70279

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

1.3%EPSS
8.1Yüksek
CVE-2026-70571

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

1.4%EPSS
8.8Yüksek
CVE-2026-77910

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

7.8Yüksek
CVE-2026-87692

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server Subscription Edition RTM

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

2.3%EPSS
7.8Yüksek
CVE-2026-87695

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

7.5Yüksek
CVE-2026-87696

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.