CVE-2026-45502: Microsoft Exchange Server SSRF Information Disclosure Vulnerability

Technical summary

CVE-2026-45502 is a Server-Side Request Forgery (CWE-918) vulnerability in Microsoft Exchange Server that permits an authenticated attacker to initiate arbitrary network requests from the Exchange server's context. The vulnerability does not require user interaction and operates at the network level. The attack surface is confined to authenticated users, limiting exposure but not eliminating it. The resulting information disclosure is scoped to the network layer, allowing an attacker to enumerate or exfiltrate data from internal hosts that trust the Exchange server or are accessible from its network segment.

Business impact

While authentication is required, SSRF vulnerabilities can enable attackers to pivot deeper into network infrastructure, discover and probe internal services, and potentially access sensitive data repositories not directly exposed to the internet. In environments where Exchange credentials are compromised or insider threats are a concern, this vulnerability becomes a pathway for lateral movement and reconnaissance. Organizations should assess whether the confidentiality impact of internal network enumeration and data exposure aligns with their risk tolerance.

Affected systems

Microsoft Exchange Server (multiple editions) and Microsoft Exchange Server Subscription Edition are affected. Verify exact version ranges and availability of updates against the Microsoft security advisory, as patch availability may vary by release branch and support lifecycle.

Exploitability

Exploitability is straightforward for authenticated users with valid credentials. An attacker does not need to trick users or bypass additional controls; they can directly invoke the vulnerable code path. However, the requirement for prior authentication—obtaining or compromising valid Exchange credentials—raises the barrier to opportunistic external exploitation. The attack cannot be executed unauthenticated. In environments with weak credential hygiene or high insider threat risk, exploitability escalates materially.

Remediation

Apply the security patch provided by Microsoft for your affected Exchange Server version as soon as practical. Microsoft's advisory should specify patch availability by product version and servicing channel. Organizations unable to patch immediately should review authentication controls to Exchange and monitor for suspicious authenticated activity. Network segmentation limiting Exchange server outbound connectivity can reduce the risk of information exfiltration to external targets.

Patch guidance

Consult the Microsoft security advisory for CVE-2026-45502 to identify the correct patch version for your Exchange Server edition and deployment model (on-premises vs. subscription-based). Test patches in a non-production environment before enterprise deployment to ensure compatibility with your configuration. Organizations on extended support or custom configurations should verify patch applicability and any dependencies before rollout.

Detection guidance

Monitor Exchange Server logs for unusual outbound network connections originating from the server process, particularly to non-standard ports or internal IP ranges. Observe authenticated session behavior for requests that attempt to access external URLs or internal network resources unusual for normal operations. Consider implementing egress filtering or proxy logging to capture and alert on unexpected Exchange-initiated traffic. Audit successful and failed authentication events to identify credential compromise that could enable this attack.

Why prioritize this

This vulnerability merits near-term attention but not emergency-level response. The CVSS 3.1 score of 5.0 (Medium severity) reflects low attack complexity and no user interaction against a large attack surface (CVSS AV:N). However, authentication requirement limits immediate external threat. Organizations should prioritize patching on a standard security cycle (within 30–60 days) while focusing higher-priority resources on unpatched critical vulnerabilities. Environments with weak identity controls or recent credential incidents should elevate urgency.

Risk score, explained

The CVSS 3.1 score of 5.0 is driven by: Network accessibility (AV:N) and low complexity (AC:L) increase exposure; authentication requirement (PR:L) substantially reduces attack surface; scope change (S:C) acknowledges the ability to impact other systems; confidentiality impact (C:L) reflects information disclosure, while integrity and availability remain unaffected (I:N/A:N). The resulting Medium severity appropriately captures a real but bounded risk that does not pose immediate system compromise or widespread availability concerns.

Frequently asked questions