ProxyNotShell: Exchange zero-days, no patch
On-premises Exchange servers are under attack again. Apply the mitigation, and plan your way off on-prem mail.
Last week Microsoft confirmed two Exchange Server zero-days (CVE-2022-41040 and CVE-2022-41082), already used in attacks. Together they can let an attacker run code on the server. They need an ordinary mailbox login first, which attackers can usually get through phishing.
There’s no patch yet. Microsoft has published a mitigation, a URL rewrite rule, and has already had to update it once because researchers found ways around the first version.
If you run Exchange on your own servers:
- Apply the latest mitigation (or let the Exchange Emergency Mitigation Service do it) and check again in a few days.
- Block remote PowerShell for normal users. It’s rarely needed.
- Look for web shells and odd processes started by IIS.
- Install the patch the day it ships.
And the bigger question. After ProxyLogon, ProxyShell and now this, ask whether running Exchange yourself is still worth it. For most small and medium companies, hosted mail is now the safer choice.