What is the CVSS score of CVE-2026-45504?

CVE-2026-45504 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Exchange Server are affected by CVE-2026-45504?

Microsoft Exchange Server deployments face significant risk from a privilege escalation vulnerability (CVSS 8.8) enabling authenticated attackers to escalate mailbox access through…. A patch is available.

How to fix or mitigate CVE-2026-45504?

Within 24 hours: Inventory all Microsoft Exchange Server deployments and current versions; enable comprehensive logging for SSRF-related network requests and authentication anomalies. Within 7 days: Implement network-level access controls restricting Exchange server outbound connectivity to only necessary services; enforce multi-factor authentication (MFA) for all Exchange administrative and sensitive mailbox access; deploy endpoint detection/response (EDR) tooling on Exchange infrastructure. Within 30 days: Establish automated monitoring for Microsoft security updates and patch releases; conduct network architecture assessment to identify and isolate potential SSRF attack paths; evaluate email platform alternatives if Exchange residual risk is unacceptable to business risk tolerance.

Microsoft Exchange Server CVE-2026-45504

EUVD-2026-35680 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-09 secure@microsoft.com

GHSA-x3fg-4h2p-6mgp

SSRF Microsoft Exchange Server

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:17 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.8

DescriptionCVE.org

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation via server-side request forgery in Microsoft Exchange Server allows an authenticated attacker with low-level network access to coerce the Exchange server into making attacker-controlled requests, resulting in high impact to confidentiality, integrity, and availability. The flaw is network-exploitable with low complexity (CVSS 8.8) but requires prior authentication, and no public exploit identified at time of analysis. As a Microsoft-discovered issue (reported by secure@microsoft.com), it is consistent with the broader pattern of Exchange SSRF chains used to pivot to elevated mailbox or domain access.

Technical ContextAI

The vulnerability is rooted in CWE-918 (Server-Side Request Forgery), a class of bug where a server fetches a URL or resource using attacker-supplied input without sufficiently validating the destination. In the Exchange context, SSRF flaws have historically been weaponized against internal endpoints (Autodiscover, EWS, PowerShell remoting, backend Exchange services) because Exchange services run with high privileges and can authenticate to internal interfaces on behalf of the calling identity. The CVSS scope is Unchanged (S:U), indicating impact remains within the Exchange security context rather than crossing to the host OS, but the C:H/I:H/A:H rating means the attacker can read, modify, and disrupt resources accessible to the Exchange service account. The single NVD-listed reference is the Microsoft MSRC advisory; no CPE strings, KEV entry, or EPSS score were provided in the input.

RemediationAI

Patch available per vendor advisory - apply the security update referenced on Microsoft's MSRC page at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45504 for your Exchange Server version and cumulative update level, and confirm the exact fix build number from that advisory before deployment. As compensating controls while patching is scheduled, restrict external access to Exchange management and backend endpoints (EWS, ECP, PowerShell, Autodiscover) via the perimeter or reverse proxy, enforce multi-factor authentication on all mailbox accounts to raise the cost of the PR:L precondition, and segment Exchange servers from sensitive internal HTTP services so an SSRF cannot reach metadata, AD, or admin interfaces; note that blocking ECP/EWS at the perimeter will break OWA/Outlook-on-the-web client access for remote users and is only suitable as a short-term stopgap. Review IIS and Exchange logs for anomalous outbound or loopback requests originating from the Exchange worker process.