CVE-2022-23277

Deeper analysis

Microsoft Exchange Server is affected by CVE-2022-23277, a remote code execution vulnerability disclosed on March 9, 2022. The flaw carries a CVSS 3.1 base score of 8.8 with network attack vector, low attack complexity, and low privileges required, enabling an authenticated attacker to execute arbitrary code that can compromise confidentiality, integrity, and availability on the server.

An attacker with low-privileged access to the Exchange instance can send specially crafted requests over the network without user interaction, resulting in full remote code execution on the affected server. This allows the attacker to run commands, access sensitive data, modify system state, or deploy further payloads within the Exchange environment.

Microsoft security advisories at the referenced MSRC update guide detail available patches and mitigation steps for the vulnerability. Administrators are directed to apply the updates released for supported Exchange versions to address the issue.

The associated EPSS score reached a peak of 0.7912 with no subsequent decline, indicating sustained exploitation interest following disclosure.