Microsoft has today confirmed the existence of two new zero-day vulnerabilities allowing for remote code execution on Microsoft Exchange Server 2013, 2016, and 2019, following previous claims made by security researchers at Vietnamese cybersecurity firm GTSC. “The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker,” Microsoft said.

Read full article on Infosecurity