> Source: [sk180064](https://support.checkpoint.com/results/sk/sk180064) # sk180064 - Customer Guidance for reported Zero-day vulnerabilities in Microsoft Exchange Server (CVE-2022-41040, CVE-2022-41082) | Property | Value | |----------|-------| | Solution ID | sk180064 | | Date Created | 2022-09-30 | | Last Modified | 2022-10-04 | | Technical Level | General | | Products | Security Gateway, Endpoint Security | | Versions | R82.10, R82, R81.20, Cloud, R82.20 | ## Solution On September 29, 2022, two new and undisclosed vulnerabilities were announced: [CVE-2022-41040](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-41040) and [CVE-2022-41082](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41082). These vulnerabilities could allow an attacker to perform remote code execution (RCE) on affected Microsoft Exchange servers. At this time, Microsoft is aware of limited targeted attacks using the two vulnerabilities to get into users' systems. In these attacks, CVE-2022-41040 can enable an authenticated attacker to remotely trigger CVE-2022-41082. Note that authenticated access to the vulnerable Exchange Server is necessary to successfully exploit either of the two vulnerabilities. Microsoft Exchange customers should review and apply the [Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server](https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/).
Check Point provides preventive behavioral protections for vulnerabilities and its post-infection activities across these products: |----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Product** | **Protection** | | **Quantum IPS** | Check Point released this IPS protections to its Optimized and Strict profiles in PREVENT mode (by default): [Microsoft Exchange Server Remote Code Execution (CVE-2022-41082)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41082). This protection also covers [CVE-2022-41040](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-41040). To view this IPS protection in SmartConsole: 1. From the left navigation panel, click Security Policies. 2. In the upper pane, click Threat Prevention \> Custom Policy. 3. In the lower pane, click IPS Protections. 4. In the top search field, enter the name of the CVE number. **Best Practice** * Check Point recommends to use the Automatic Updates for IPS releases to get relevant protections quickly to block ongoing attacks. * Check Point recommends activating HTTPS Inspection (in the Security Gateway / Cluster object properties \> HTTPS Inspection view), as the attack payload may appear in encrypted or decrypted traffic. | | **Quantum Threat Emulation** | * *Exploit.Wins.ProxyShell.E* | | **Harmony Endpoint for Windows** | * *Exploit.Win.ProxyShell.A* * *Exploit.Win.ProxyShell.B* * *Exploit.Win.ProxyShell.C* * *Exploit.Win.ProxyShell.D* | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content