CVE-2022-41082
Published: 03 October 2022
Summary
CVE-2022-41082 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Microsoft Exchange Server. Its CVSS base score is 8.0 (High).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Microsoft Exchange Server is affected by a remote code execution vulnerability tracked as CVE-2022-41082 and assigned CWE-502. The flaw carries a CVSS 3.1 base score of 8.0 with an attack vector of adjacent network, low attack complexity, and low required privileges, enabling high impact on confidentiality, integrity, and availability.
An authenticated attacker positioned on the adjacent network can exploit the issue without user interaction to execute arbitrary code on the Exchange server, achieving full control over the affected system.
Microsoft security advisories referenced in the MSRC update guide and related bulletins direct administrators to apply the patches released for this vulnerability as the primary mitigation, with additional guidance available through the November 2022 Patch Tuesday distribution that addressed multiple Exchange issues.
The associated EPSS score reached a peak of 0.9701 and currently stands at 0.9082, indicating sustained exploitation interest following disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-44326
Vulnerability details
Microsoft Exchange Server Remote Code Execution Vulnerability
- CWE(s)
- KEV Date Added
- 30 September 2022
Related Threats
Threat-Actor AttributionAI
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the Microsoft security update that eliminates the deserialization flaw exploited by CVE-2022-41082.
Enforces validation of untrusted data before deserialization, blocking the exact attack vector (CWE-502) used for remote code execution.
Boundary-protection mechanisms can restrict adjacent-network access to Exchange endpoints, reducing the attack surface for unauthenticated RCE attempts.