What is the CVSS score of CVE-2026-45503?

CVE-2026-45503 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Exchange Server are affected by CVE-2026-45503?

Microsoft Exchange Server CVE-2026-45503 is a high-severity SSRF vulnerability (CVSS 8.1) enabling authenticated attackers with low-level privileges to force unauthorized outbound requests from…. A patch is available.

How to fix or mitigate CVE-2026-45503?

Within 24 hours: Inventory all Microsoft Exchange Server deployments and versions in production; establish baseline of authorized outbound connections from Exchange infrastructure. Within 7 days: Implement strict egress firewall rules limiting Exchange outbound traffic to approved destinations only; deploy monitoring and alerting for unauthorized outbound requests from Exchange servers; audit and disable unnecessary low-privilege Exchange user accounts. Within 30 days: Review and strengthen access controls on internal resources reachable from Exchange; continue monitoring vendor security advisories for patch release; implement additional authentication controls on critical internal endpoints.

Microsoft Exchange Server CVE-2026-45503

EUVD-2026-35679 MEDIUM

Improper Authorization (CWE-285)

2026-06-09 secure@microsoft.com

GHSA-p44w-fhq3-v2jv

Authentication Bypass Microsoft SSRF Exchange Server Exchange Server Subscription Edition

6.5

CVSS 3.1 · NVD

Temporal: 7.1

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.1 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jun 15, 2026 - 19:37 NVD

HIGH MEDIUM

CVSS changed

Jun 15, 2026 - 19:37 NVD

8.1 (HIGH) 6.5 (MEDIUM)

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:17 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.1

DescriptionNVD

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

AnalysisAI

Server-side request forgery in Microsoft Exchange Server allows an authenticated attacker with low privileges to coerce the Exchange server into making arbitrary outbound requests, resulting in disclosure of sensitive information and potential integrity impact across internal network resources. The CVSS 8.1 score reflects the high confidentiality and integrity impact from a network-reachable, low-complexity attack, though no public exploit identified at time of analysis. The vulnerability is tagged as an Authentication Bypass / SSRF, suggesting the SSRF primitive may be leveraged to bypass network-based authentication boundaries (e.g., reaching internal trusted endpoints).

Technical ContextAI

Microsoft Exchange Server is a widely deployed enterprise messaging platform that exposes numerous HTTP-based services (OWA, ECP, EWS, Autodiscover, MAPI/HTTP) which historically have been frequent SSRF vectors due to Exchange's design where the server itself makes back-end calls on behalf of clients. The CWE-285 (Improper Authorization) classification indicates the root cause is a missing or flawed authorization check on a request-issuing function, allowing a low-privileged user to instruct the server to fetch resources it should not be permitted to reach. SSRF in Exchange is particularly dangerous because Exchange servers often hold elevated Active Directory privileges and reside on trusted network segments, making outbound server-initiated requests effective for reaching internal-only endpoints, cloud metadata services in hybrid deployments, or other Exchange-internal endpoints that trust the originating host.

RemediationAI

Patch availability per vendor advisory is implied by the MSRC reference at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45503 - administrators should consult that page for the exact Security Update (SU) and Cumulative Update (CU) build numbers required and apply them via Windows Update or by downloading the SU package and running it elevated, then verifying the Exchange Setup/Recovery completed and services restarted cleanly. As compensating controls while patching is scheduled, restrict outbound HTTP/HTTPS egress from Exchange servers to only required Microsoft endpoints (which limits SSRF blast radius but may break hybrid/Office 365 connectors if over-tightened), require multi-factor authentication on all mailbox accounts to raise the cost of obtaining the low-privileged credential the attack requires, and consider placing OWA/ECP behind a reverse proxy or VPN to reduce the population of attackers who can reach the vulnerable endpoint. Monitor IIS logs on Exchange for anomalous request patterns to ECP/EWS/Autodiscover endpoints from authenticated users.