OWASSRF, a new exploit for Exchange vulnerabilities

November 2, 2026 3 min read

A new exploit method, referred to as OWASSRF, has been discovered by researchers and exploited in the wild. This exploit combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution (RCE) through Outlook Web Access (OWA). The OWASSRF exploit successfully bypasses URL rewrite mitigations previously provided by Microsoft for ProxyNotShell.

On September 29, 2022, reports emerged of active exploitation of two zero-day vulnerabilities in Microsoft Exchange, which could allow remote code execution (RCE). These vulnerabilities were identified by Microsoft as CVE-2022-41040, a server-side request forgery (SSRF) vulnerability, and CVE-2022-41082, which allows RCE. These vulnerabilities were collectively referred to as ProxyNotShell.

On December 20th, researchers detected a new exploit that has been used by malicious actors to bypass the mitigations suggested by Microsoft and dubbed it OWASSRF. While the original ProxyNotShell exploit targeted CVE-2022-41040, the flaw used by the new exploit is likely to be CVE-2022-41080, a critical security flaw that allows for remote privilege escalation on Exchange servers and has not previously been observed being exploited in the wild.

Timeline

Based on our data, 80% of cloud environments that use vulnerable Microsoft Exchange products have patched their Exchange servers against the exploited vulnerabilities.

The Play ransomware group has deployed OWASSRF to bypass ProxyNotShell URL rewrite mitigations and achieve remote code execution (RCE) on vulnerable servers through Outlook Web Access (OWA). The group primarily targets the Latin American region, with Brazil being the top target. Their tactics, techniques, and procedures (TTPs) are similar to those used by the Hive and Nokayawa ransomware families, including the use of AdFind, a command-line query tool used to gather information from Active Directory. To execute arbitrary commands on compromised servers, the ransomware operators leveraged Remote PowerShell to abuse the CVE-2022-41082 vulnerability, which was also exploited by the ProxyNotShell exploit. Additional tools used by the group include Connectwise Screen Connect and BITSadmin.

The following TTPs and IOCs have been published by multiple researchers (see references) that can be used to detect compromised Exchange servers:

Tactic	IOC/Tools
TA0001 – Initial Access	45[.]76[.]141[.]84
TA0001 – Initial Access	45[.]76[.]143[.]143
TA0001 – Initial Access	179[.]60[.]149[.]28
TA0002 – Execution	Powershell spawned by IIS (‘w3wp.exe’)
TA0003 – Persistence	BITSadmin
TA0006 – Credential Access	Mimikatz
TA0002 – Execution / TA0009 – Collection	Screen Connect