What is the CVSS score of CVE-2026-45501?

CVE-2026-45501 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-45501?

Yes, a patch is available for CVE-2026-45501. Update the affected software to the latest version immediately.

Microsoft Exchange Server CVE-2026-45501

EUVD-2026-35677 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-09 secure@microsoft.com

GHSA-rc45-hpv2-j3hh

XSS Microsoft SSRF Exchange Server Exchange Server Subscription Edition

6.1

CVSS 3.1 · NVD

Temporal: 5.7

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

5.7 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 15, 2026 - 19:37 NVD

6.5 (MEDIUM) 6.1 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 19:42 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 6.5

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Cross-site scripting and server-side request forgery in Microsoft Exchange Server enables authenticated low-privilege network attackers to perform spoofing and exfiltrate sensitive information. Affected are Exchange Server 2016 CU23, 2019 CU14, 2019 CU15, and the Subscription Edition RTM release lines, all below their respective patched cumulative update builds. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though Microsoft has released patches across all affected branches.

Technical ContextAI

The vulnerability resides in Microsoft Exchange Server's web interface layer, which generates dynamic HTML content for browser-based access. CWE-918 (Server-Side Request Forgery) is assigned despite the CVE description explicitly naming cross-site scripting - a meaningful discrepancy. SSRF in Exchange typically manifests when user-supplied input is incorporated into server-initiated HTTP or backend requests without adequate validation, allowing the server itself to be weaponized as a proxy to reach internal resources. The CVSS vector reinforces the SSRF classification: UI:N (no victim browser interaction required) and C:H/I:N/A:N (high confidentiality loss, no write or denial-of-service) are characteristic of SSRF rather than reflected or stored XSS, which conventionally requires UI:R. The tags list both XSS and SSRF, suggesting the vulnerability may involve an input-reflection mechanism that simultaneously facilitates server-side request forgery. Affected CPE targets span Exchange 15.01.x (2016) and 15.02.x (2019/SE) builds.

RemediationAI

Upgrade to the patched cumulative update for your Exchange branch: Exchange Server 2016 CU23 should be updated to build 15.01.2507.069 or later; Exchange Server 2019 CU14 to 15.02.1544.041 or later; Exchange Server 2019 CU15 to 15.02.1748.046 or later; and Exchange Server Subscription Edition RTM to 15.02.2562.043 or later. Patch details are published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501. If immediate patching is not possible, restrict authenticated access to Exchange's web-facing endpoints (OWA, ECP, EWS) to trusted network segments or VPN-authenticated sessions only - this reduces exposure by limiting which authenticated users can reach the vulnerable input-handling surface. Note that restricting OWA/ECP access may disrupt remote workers relying on browser-based mail access. Web Application Firewall rules blocking SSRF-pattern payloads (internal IP ranges, metadata endpoint URIs, localhost references in request parameters) can provide partial compensating control but should not be treated as a substitute for patching given Exchange's complex attack surface.