CVE-2022-24516

Deeper analysis

Microsoft Exchange Server contains an elevation of privilege vulnerability tracked as CVE-2022-24516. The flaw received a CVSS 3.1 score of 8.0 with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating that a remote attacker can obtain high impact on confidentiality, integrity, and availability after satisfying low-privilege and user-interaction conditions.

An authenticated user with limited rights can exploit the issue over the network to elevate privileges on the Exchange server, potentially gaining the ability to read, modify, or delete sensitive data and disrupt service operations. The requirement for user interaction implies the attacker must induce a target to perform a specific action that triggers the flaw.

Microsoft has published remediation guidance in its Security Response Center update guide for this vulnerability. The associated EPSS score rose from a low baseline to a recorded peak of 0.1570 before settling at the current value of 0.1012, indicating that exploitation interest increased after public disclosure.