Microsoft Exchange Server CVE-2026-45503

Exploitation requires valid credentials for any authenticated user with low privileges on the target Exchange Server (PR:L per CVSS), meaning a standard mailbox account is sufficient - no administrative role is needed. Network reachability to the Exchange Server's HTTP-based services (typically OWA, ECP, EWS, or Autodiscover on TCP/443) is required, which is commonly internet-exposed for on-premises Exchange deployments and reachable from internal networks otherwise. No user interaction is required (UI:N) and attack complexity is low (AC:L), so no race conditions or unusual configurations need to be coaxed. Limiting factors are the credential requirement and the fact that the impact is information disclosure plus integrity (C:H/I:H, A:N) rather than direct code execution, meaning the SSRF primitive's ultimate value depends on what internal endpoints the Exchange server can reach in the victim environment.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, yielding high confidentiality and integrity impact - a meaningful 8.1 score. There is no KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided in the input, so widespread opportunistic exploitation cannot be confirmed. However, Exchange Server has a strong historical pattern of SSRF/authorization chains being weaponized (e.g., ProxyShell, ProxyNotShell), and the 'Authentication Bypass' tag combined with CWE-285 raises the realistic risk that this primitive could be chained with other Exchange flaws. The PR:L requirement (any authenticated mailbox user) is a low bar in enterprise Exchange environments where any compromised employee account suffices, so this should be treated as a high priority for organizations running on-premises Exchange even absent confirmed in-the-wild activity.

An attacker who has obtained credentials for any low-privileged Exchange mailbox user (via phishing, password spray, or prior breach) authenticates to an Exchange web endpoint such as OWA or EWS and submits a crafted request that causes the Exchange server to issue an attacker-directed HTTP request to an internal-only URL. The attacker uses this primitive to enumerate internal network services, retrieve responses from internal HTTP APIs that trust the Exchange server's network position, or pivot toward chaining with another Exchange authorization flaw. No public exploit identified at time of analysis, but the low complexity and historical pattern of Exchange SSRF abuse make development of a working exploit straightforward for a motivated attacker.