CVE-2022-23277: Microsoft Exchange Server Remote Code Execution Vulnerability

Does the attacker need to be in an authenticated role in the Exchange Server?

Yes, the attacker must be authenticated.