References https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38048 https://nvd.nist.gov/vuln/detail/CVE-2022-38048 https://www.cve.org/CVERecord?id=CVE-2022-38048 https://www.rapid7.com/blog/post/2022/10/11/patch-tuesday-october-2022/ https://support.microsoft.com/zh-cn/topic/office-2016-%E5%AE%89%E5%85%A8%E6%9B%B4%E6%96%B0%E8%AF%B4%E6%98%8E-2022-%E5%B9%B4-10-%E6%9C%88-11-%E6%97%A5-kb5002026-37b9c5fc-75f3-4996-8663-473bf2aa46ba https://www.secrss.com/articles/47920 https://vuldb.com/vuln/210476 https://www.tenable.com/plugins/nessus/166037 https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2022/
Related VulnerabilitiesPoCCVE-2026-58644: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCEMicrosoft SharePoint /_layouts/15/ToolPane.aspx 代码执行漏洞(CVE-2025-53770)Microsoft SharePoint Server /_trust/default.aspx 代码执行漏洞(CVE-2026-50522)Microsoft SharePoint Server JWT 权限绕过漏洞(CVE-2026-55040)PoCdzzoffice-installer: DzzOffice - Installer Page Exposure泛微e-office /iWebOffice/Signature/SignatureDel.php SQL 注入漏洞万户 ezOFFICE /defaultroot/iWebOfficeSign/OfficeServer.jsp/../../platform/bpm/work_flow/operate/wf_relation.jsp SQL 注入漏洞PoCCVE-2026-25512: Group-Office < 26.0.5 - Remote Code ExecutionPoCCVE-2021-28480: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)PoCCVE-2021-28481: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)PoCCVE-2025-5301: ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site ScriptingPoCsharepoint-lists-api-disclosure: Microsoft SharePoint - List API DisclosurePoCsharepoint-layouts-disclosure: Microsoft SharePoint - Layouts Disclosure