Which products and versions are affected by CVE-2022-41080?

Affected: Exchange Server (Microsoft) versions 2013-cumulative_update_23, 2016-cumulative_update_22, 2016-cumulative_update_23, 2019-cumulative_update_11, 2019-cumulative_update_12; Microsoft Exchange Server 2013 Cumulative Update 23 versions >= 15.00.0; Microsoft Exchange Server 2016 Cumulative Update 22 versions >= 15.0.0, among others. The full list is in the CVE brief.

Is CVE-2022-41080 being exploited in the wild?

It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 20, 2022 and is known to be used in ransomware campaigns.

Is CVE-2022-41080 in the CISA KEV catalog?

Yes. It was added on Jan 10, 2023 with a federal remediation due date of Jan 31, 2023.

Is there a public exploit for CVE-2022-41080?

Public exploit code is available.

How urgently should CVE-2022-41080 be patched?

Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Request A Demo

Vulnerability Intelligence

CVE-2022-41080

CriticalExploitedPublic exploit

Microsoft Exchange Server Elevation of Privilege Vulnerability

Published Jan 11, 2023 · Updated Aug 10, 2026

Key Facts

Patch immediately

CVE-2022-41080 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Exchange Server (Microsoft), Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Exchange Server 2016 Cumulative Update 22 and 3 more products.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 20, 2022 and is known to be used in ransomware campaigns. Public exploit code is available.
EPSS estimates a 77% probability of exploitation in the next 30 days.
Fixed versions are available, including Microsoft Exchange Server 2013 Cumulative Update 23 15.00.1497.044, Microsoft Exchange Server 2016 Cumulative Update 22 15.01.2375.037, Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.016.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

77%

Higher than 99.5% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings, used by ransomware

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2022-41080 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Microsoft Exchange Server Elevation of Privilege Vulnerability

Known-Exploited Catalog Listings

Catalog	Added	Remediation due	Ransomware use
CISA KEV	Jan 10, 2023	Jan 31, 2023	Known
Industry KEV feed	Dec 20, 2022	Jan 31, 2023	Known
CIRCL KEV	Jan 10, 2023	Jan 31, 2023	Known
ENISA EUVD	Jan 10, 2023	n/a	Not reported

Required action: Apply updates per vendor instructions.

Affected Products

10 affected entries in total

Product	Affected versions	Fixed in
Exchange ServerMicrosoft	2013-cumulative_update_23, 2016-cumulative_update_22, 2016-cumulative_update_23, 2019-cumulative_update_11, 2019-cumulative_update_12	n/a
Microsoft Exchange Server 2013 Cumulative Update 23	>= 15.00.0	15.00.1497.044
Microsoft Exchange Server 2016 Cumulative Update 22	>= 15.0.0	15.01.2375.037
Microsoft Exchange Server 2016 Cumulative Update 23	>= 15.01.0	15.01.2507.016
Microsoft Exchange Server 2019 Cumulative Update 11	>= 15.02.0	15.02.0986.036

1 more affected products in the full CVE brief

Patched Releases

Microsoft Exchange Server 2013 Cumulative Update 23

15.00.1497.044

Microsoft Exchange Server 2016 Cumulative Update 22

15.01.2375.037

Microsoft Exchange Server 2016 Cumulative Update 23

15.01.2507.016

Microsoft Exchange Server 2019 Cumulative Update 11

15.02.0986.036

Microsoft Exchange Server 2019 Cumulative Update 12

15.02.1118.020

Timeline

Added to Industry KEV feed
Dec 20, 2022
Added to CISA KEV
Jan 10, 2023
Added to CIRCL KEV
Jan 10, 2023
Added to ENISA EUVD
Jan 10, 2023
Publicly disclosed
Jan 11, 2023
Last updated
Aug 10, 2026

References

15 more references in the full CVE brief

FAQ

Common Questions.

Microsoft Exchange Server Elevation of Privilege Vulnerability
Affected: Exchange Server (Microsoft) versions 2013-cumulative_update_23, 2016-cumulative_update_22, 2016-cumulative_update_23, 2019-cumulative_update_11, 2019-cumulative_update_12; Microsoft Exchange Server 2013 Cumulative Update 23 versions >= 15.00.0; Microsoft Exchange Server 2016 Cumulative Update 22 versions >= 15.0.0, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Dec 20, 2022 and is known to be used in ransomware campaigns.
Yes. It was added on Jan 10, 2023 with a federal remediation due date of Jan 31, 2023.
Public exploit code is available.
Fixed versions are available, including Microsoft Exchange Server 2013 Cumulative Update 23 15.00.1497.044, Microsoft Exchange Server 2016 Cumulative Update 22 15.01.2375.037, Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.016.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.

Is CVE-2022-41080 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.