Actively exploited in the wild
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft - Exchange Server · Listed in the CISA KEV since 2022-09-30. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-41040
HighCVSS 8.8KEVSummary
A vulnerability in Microsoft Exchange Server allows for elevation of privilege. Technical details are not provided in the description.
Risk Assessment
An attacker could exploit this vulnerability to elevate privileges on the Exchange system. This could lead to unauthorized data access or further exploitation.
Recommendation
Apply security updates for Microsoft Exchange Server. Monitor for unusual activity on the server.
Other vulnerabilities in Microsoft Exchange Server
See all- CVE-2026-69641Critical
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69356Critical
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-55008Critical
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.
- CVE-2026-45502Medium
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
- CVE-2026-42897HighActively exploited
Microsoft Exchange Server has an improper neutralization of input during web page generation, leading to a cross-site scripting vulnerability. This flaw allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-21527Medium
A flaw in the user interface of Microsoft Exchange Server leads to misrepresentation of critical information, allowing an unauthorized attacker to perform spoofing over a network.
- CVE-2025-53786High
On April 18th, 2025, Microsoft announced security changes for Exchange Server in hybrid deployments and accompanying hot fixes. Further investigation revealed specific security implications related to these changes.
- CVE-2024-21410CriticalActively exploited
Microsoft Exchange Server Elevation of Privilege Vulnerability. Technical details are not provided in the description.
- CVE-2023-38182High
A vulnerability in Microsoft Exchange Server allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
- CVE-2023-38181High
A vulnerability in Microsoft Exchange Server allows attackers to spoof other email addresses. Exploiting this flaw could lead to email communication fraud.
Original NVD description (English source)
Microsoft Exchange Server Elevation of Privilege Vulnerability