Microsoft Exchange zero-day 2022

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Microsoft Exchange zero-day 2022

L4 Transporter

According to below link Microsoft Exchange have expose to new vulnerability again . I am using Palo Alto firewall PAN-OS 9.1.14 may I know Palo Alto firewall is able to detect this vulnerability ? and where to check it since I do not have CVE number. 

New Microsoft Exchange zero-day actively exploited in attacks (bleepingcomputer.com)

 

Warning: New attack campaign utilized a new 0-day RCE vulnerability on Microsoft Exchange Server | B...

2 accepted solutions

Accepted Solutions

Here is the KB article for the vulnerabilities (CVE-2022-41040 and CVE-2022-41082). When there's an update on the signature coverage, the KB will also be updated.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sZK9CAM

 

View solution in original post

L5 Sessionator

A signature (TID:91368) for CVE-2022-41040 was released in the content version 8624.
Based on our research, blocking CVE-2022-41040 can be the mitigation of CVE-2022-41082.

 

Unit42 also published a blog:
https://unit42.paloaltonetworks.com/proxynotshell-cve-2022-41040-cve-2022-41082/

 

View solution in original post

4 REPLIES 4

L5 Sessionator

Currently, Palo Alto Networks is researching on the vulnerability. There's no signature available yet.

 

For your reference: "A vulnerability/CVE is released; when will the vulnerability signature[IPS] be released? Why do some CVEs not have vulnerability signatures? What is default action?"
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAOnCAO

 

When there's an update, I can share the status here.

I check the portal site; however, nothing is public as of yet. Any update on the signature release?

Here is the KB article for the vulnerabilities (CVE-2022-41040 and CVE-2022-41082). When there's an update on the signature coverage, the KB will also be updated.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sZK9CAM

 

L5 Sessionator

A signature (TID:91368) for CVE-2022-41040 was released in the content version 8624.
Based on our research, blocking CVE-2022-41040 can be the mitigation of CVE-2022-41082.

 

Unit42 also published a blog:
https://unit42.paloaltonetworks.com/proxynotshell-cve-2022-41040-cve-2022-41082/

 

  • 2 accepted solutions
  • 4066 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!