Quick Answer — In September–October 2022, two Microsoft Exchange zero-days (CVE-2022-41040 SSRF + CVE-2022-41082 RCE, together “ProxyNotShell”) were reported — and then appeared for sale on a UniCC-style forum before patches existed. Attackers raced exploitation into the patch gap; Microsoft’s mitigations were bypassed within days; mass scanning hit unpatched servers worldwide. The chaos defined the modern zero-day response problem: bugs found, auctioned, exploited, and mitigated — all before the fix lands. The lesson: exchange edge servers are perpetual zero-day magnets; architecture that assumes compromise (segmentation, EDR on mail edges) beats patch-race heroics. (Note: this article covers a security event; see web vulnerability primers for background.)
What happened
Per the GTSC discovery report (the Vietnamese MSSP that found exploitation first), Microsoft’s advisories, and contemporaneous threat intel:
- Discovery. In late September 2022, GTSC incident-responded active intrusions using two chained Exchange bugs: an SSRF (41040) to reach Exchange’s PowerShell backend, then authenticated RCE (41082) — the ProxyLogon/ProxyShell family shape, new pair.
- The leak. Before any patch, a threat actor posted the exploit chain for sale on an underground forum. Researchers watched the auction; exploitation spread. The buyers were subsequently observed deploying webshells and making ransomware-adjacent moves per reporting.
- Mitigation whack-a-mole. Microsoft published a URL-rewrite mitigation (October), which researchers bypassed within roughly a day; a revised rule followed. Exchange Online was never exposed; on-prem servers were the battleground.
- The patch. Fixes landed November 8, 2022 (November patch Tuesday) — weeks after discovery and active exploitation, closing the chain for supported builds.
Impact and numbers
| Metric | Value |
|---|---|
| CVEs | CVE-2022-41040 (SSRF) + CVE-2022-41082 (RCE) — “ProxyNotShell” |
| Severity | CVSS 9.8 / 8.8 (chain = pre-auth RCE in practice reports) |
| Discovered | Late September 2022 (GTSC, active exploitation) |
| Exploit sale | Posted for sale on underground forum pre-patch (October 2022) |
| Patch | November 8, 2022 Patch Tuesday |
| Observed use | Webshells, credential theft, ransomware precursors per incident reports |
Why the auction changed the tempo
Zero-days used to be used quietly, burned once. The ProxyNotShell auction — exploit code listed for sale while defenders watched — compressed the timeline: purchase, mass-deploy, patch-gap race. That new economics (zero-day markets with inventory and support contracts) forces a defensive assumption: between discovery and patch, someone is selling, someone is buying, and scanners are probing you nightly. Microsoft’s mitigation-then-bypass week demonstrated that interim rules are tamper-tape, not doors. The orgs that escaped unscathed shared traits: mail-edge servers segmented from the LAN, EDR with behavioral rules on Exchange boxes, and rehearsed emergency-patch muscle — the “assume the edge is owned” posture that 2023+ architectures made explicit.
Timeline
| Date | Event |
|---|---|
| 2022-09-28 ≈ | GTSC reports active exploitation of the chain (initial advisory) |
| 2022-09-30 | Microsoft confirms two zero-days; mitigations published (URL rewrite) |
| 2022-10 | Exploit posted for sale on underground forum; mitigation bypass published by researchers; revised rules issued |
| 2022-11-08 | Patch Tuesday ships fixes for both CVEs |
| 2022 → 2023 | Mass scanning and opportunistic exploitation of unpatched servers continues; KEV-listed |
Why it still matters in 2026
Because the proxy-family bugs keep coming (ProxyLogon 2021, ProxyShell 2021, ProxyNotShell 2022, and successors), and the response template this incident forged is now standard: assume the edge server is breachable, contain its blast radius in advance. Segment mail edges from everything, treat their credentials as burner credentials, run EDR behavioral detection tuned to PowerShell-abuse shapes, and maintain the emergency patch runbook that can go from advisory to rebooted in hours. The auction element also seeded today’s threat-intel practice of monitoring criminal marketplaces for your vendor names — because the next auction of your edge software may already be live while you read the advisory.
The chain, in one diagram
internet
|
Exchange Front-End
(autodiscover etc.)
|
CVE-2022-41040: SSRF
(forge request into
backend PowerShell )
|
CVE-2022-41082: RCE
via PowerShell exec
|
webshell / creds /
ransomware staging
|
(patch Nov 8; interim
URL-rewrite = tamper
tape, bypassed in ~1d)Detection and hardening takeaways
- Segment mail edges hard. Exchange servers sit in a DMZ-like tier, talking only to required services — owned-edge assumption built into topology.
- EDR on Exchange boxes. The chain’s second half is PowerShell abuse; behavioral detections on abnormal Exchange PowerShell sessions catch variants patches haven’t named yet.
- Credential tiering for service accounts. Edge-server credentials are assumed-leaked; give them no domain privileges worth stealing.
- Rehearse emergency patching. The orgs that won the patch race had a tested path: advisory-to-test-to-production within 72 hours.
- Track mitigation bypasses. When a vendor ships an interim rule, assume it will be bypassed and schedule the real fix immediately — tamper-tape weeks are attack weeks.
Who exploited ProxyNotShell?
Multiple actors, per threat-intel reporting: the auction made it available broadly, and GTSC’s original intrusions were tentatively tracked to a China-nexus actor before the marketplace widened access. Opportunistic ransomware precursors followed. The honest attribution line: state-nexus early, commercial-everyone later — a pattern that repeated through 2023’s edge-device zero-days.
Was Exchange Online affected?
No — the vulnerable components were on-premises Exchange (and hybrid servers with public-facing autodiscover/HTTP endpoints). Exchange Online’s shared infrastructure was not exposed to the chain. This on-prem-vs-cloud split shaped enterprise response in 2022: cloud-mail orgs watched calmly while on-prem admins lived the patch-gap weeks, accelerating several migrations.
What does the name mean?
ProxyNotShell follows the community naming convention for this bug family (ProxyLogon, ProxyShell): “Proxy” for the front-end proxy handler the SSRF abuses, “NotShell” a wry marker that it is a different pair than 2021’s ProxyShell despite the same attack shape. The names stuck because the bugs kept chaining through the same architectural seam — the Exchange front-end/back-end proxy trust — which is itself the durable lesson: one weak trust relationship, endlessly re-exploited, until architecture changes.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
