Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Microsoft Exchange Server Elevation of Privilege Vulnerability
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N U H H H 8.8 .7733 99.5 YES
AFFECTED
Product Versions Fixed
Microsoft Exchange Server 2013 Cumulative Update 23 15.00.0 – —
Microsoft Exchange Server 2016 Cumulative Update 22 15.0.0 – —
Microsoft Exchange Server 2016 Cumulative Update 23 15.01.0 – —
Microsoft Exchange Server 2019 Cumulative Update 11 15.02.0 – —
Microsoft Exchange Server 2019 Cumulative Update 12 15.02.0 – —
TIMELINE
Sep 19 Reserved by microsoft
Jan 10 Added to CISA KEV, remediation due 2023-01-31
Jan 10 Published (CNA: microsoft)
Description
Microsoft Exchange Server Elevation of Privilege Vulnerability
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 19, 2022 | Reserved | Reserved by microsoft |
| January 10, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-01-31 |
| January 10, 2023 | Published | Published (CNA: microsoft) |
Affected
Affected products and packages — 5 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Microsoft | Microsoft Exchange Server 2013 Cumulative Update 23 | — | 15.00.0 | — |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 22 | — | 15.0.0 | — |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 23 | — | 15.01.0 | — |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 11 | — | 15.02.0 | — |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 12 | — | 15.02.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-41080 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.