Loading story…
Microsoft warned that attackers were actively exploiting a zero-day chain in on-premises Microsoft Exchange Server, later tracked as ProxyNotShell and assigned CVE-2022-41040 and CVE-2022-41082. The flaws affected Exchange Server 2013, 2016, and 2019, while Exchange Online was not affected. The attack chain used a server-side request forgery (SSRF) bug to reach PowerShell remoting and achieve remote code execution, and reports indicated the activity required valid email credentials from a non-admin user.
Microsoft and security researchers urged organizations to apply interim protections immediately, including an IIS URL Rewrite rule to block known exploit paths and restricting or disabling Remote PowerShell where possible. Guidance also highlighted the need to review IIS logs and related telemetry for signs of compromise, as the campaign was reportedly already being used in real-world attacks and drew comparisons to the earlier ProxyShell exploitation wave.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft Security Response Center published customer guidance for the reported Exchange zero-days, assigning CVE-2022-41040 and CVE-2022-41082. Microsoft said Exchange Online was not affected and recommended temporary mitigations including an IIS URL Rewrite rule and restricting Remote PowerShell where possible.
Public discussion of the Exchange zero-day campaign began on September 29, 2022, including a GTSC blog post warning of active exploitation. The campaign involved a new attack chain against Microsoft Exchange Server.
The Exchange vulnerabilities later dubbed ProxyNotShell were reported as having been actively exploited in the wild for at least a month before public disclosure. The chain affected on-premises Exchange Server 2013, 2016, and 2019 and required valid credentials.
GTSC reported the Microsoft Exchange vulnerabilities to Microsoft through the Zero Day Initiative. A later reference states this report was made 22 days before public discussion began.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited the **ProxyNotShell** chain on on-premises Microsoft Exchange Server by combining `CVE-2022-41040`, an authenticated SSRF flaw, with `CVE-2022-41082`, a remote code execution bug reachable through Exchange PowerShell remoting. Microsoft confirmed that Exchange Server **2013, 2016, and 2019** were affected, and the flaws were reported as being used against critical infrastructure before patches were released. The intrusion path exposed the Exchange PowerShell endpoint through crafted requests and then abused `WSMAN` and XML SOAP traffic to establish remote shell access. Observed post-exploitation activity included reconnaissance, DLL hijacking attempts, remote process injection, persistence, and reverse shell deployment. Investigators also documented deserialization-based execution triggered through a crafted address book request, along with malicious DLLs and binaries, a reverse proxy executable, and command-and-control infrastructure including `193.149.185.52:443` and `sync.service.auzreservices.com`, indicating that successful exploitation quickly progressed from initial access to hands-on-keyboard control.
Jun 29, 2026
Attackers actively exploited the Microsoft Exchange Server vulnerabilities **CVE-2022-41040** and **CVE-2022-41082**, widely known as **ProxyNotShell**, to gain remote code execution on vulnerable on-premises deployments. Microsoft disclosed the attacks and analyzed the exploit chain, which abuses the two flaws together, while affected products included supported **Exchange Server 2013, 2016, and 2019** cumulative update versions; **Exchange Online** was not affected. Security monitoring in the weeks after disclosure showed sustained scanning and exploitation attempts, with one SOC reporting activity beginning on October 3 and continuing intermittently through November, and more than 90% of observed source countries tied to the United States. Many requests appeared to use the **ZGrab** scanning tool based on `User-Agent` headers, and public proof-of-concept code increased the likelihood of continued abuse. Microsoft released patches for affected Exchange versions, and organizations running on-premises Exchange were urged to apply the vendor fixes without delay.
Aug 15, 2026
Researchers detailed **ProxyShell**, a chain of Microsoft Exchange vulnerabilities that can be combined to bypass authentication, escalate privileges, and achieve remote code execution on exposed Exchange servers. Orange Tsai described the attack surface and showed how flaws including `CVE-2021-34473`, `CVE-2021-34523`, and `CVE-2021-31207` could be chained to reach backend Exchange services and execute attacker-controlled code without valid credentials. Mandiant later reported real-world exploitation of ProxyShell against internet-facing Exchange environments, showing that attackers used the chain to gain shells on compromised servers and establish persistent access. The reporting underscores that unpatched on-premises Exchange systems remained a high-value target because successful exploitation could hand attackers direct control of email infrastructure, enable follow-on intrusion activity, and expose sensitive enterprise communications.
Jul 12, 2026