EUVD-2026-56447
GHSA-476g-mrq6-qc6c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSRF-driven privilege escalation grants elevated read and write access to Exchange data (C:H, I:H), but no mechanism for availability denial is described, so A:N.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
AnalysisAI
SSRF in Microsoft Exchange Server enables authenticated, low-privilege network attackers to escalate privileges, with Microsoft reporting high confidentiality, integrity, and availability impact across Exchange 2016, 2019, and Subscription Edition. Vendor-released patches are available covering all affected cumulative update branches. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.62% (46th percentile) and CISA SSVC assigns Exploitation: none - meaning the CVSS 8.8 score outpaces current real-world threat activity.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) describes a class of vulnerability where a server-side application is manipulated into making HTTP or network requests on behalf of an attacker, bypassing network controls that would otherwise block direct attacker access to internal services. In Microsoft Exchange Server - a widely deployed enterprise email and calendaring platform running on Windows Server - the application inherently processes large volumes of partially-trusted input and holds privileged network positioning within corporate environments, making SSRF particularly dangerous as a pivot mechanism toward internal authentication endpoints or administrative APIs. The CVSS vector AV:N/AC:L/PR:L confirms network-based exploitation requiring only a valid, low-privilege Exchange account with no elevated role. CPE data confirms Exchange Server 2016 across numerous cumulative updates; EUVD data extends this to Exchange 2019 CU14 and CU15 and Exchange Server Subscription Edition RTM, with specific fixed build numbers provided for each branch.
RemediationAI
Apply Microsoft's released patches immediately for internet-facing Exchange deployments. Upgrade Exchange Server 2016 CU23 to build 15.01.2507.072 or later, Exchange Server 2019 CU14 to 15.02.1544.044 or later, Exchange Server 2019 CU15 to 15.02.1748.049 or later, and Exchange Server Subscription Edition RTM to 15.02.2562.046 or later; details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65813. As a compensating control pending patching, enforce strict ingress controls so that only known corporate clients can reach Exchange web service endpoints, reducing attacker surface for the required PR:L foothold. Additionally, restrict outbound HTTP/HTTPS from Exchange servers to untrusted or lateral internal network segments to limit the SSRF reach - note this may disrupt hybrid cloud connectivity, certificate revocation lookups, or external relay configurations and should be tested before enforcement.
More in Exchange Server
View allMicrosoft Exchange Server contains a pre-authentication SSRF vulnerability known as 'ProxyShell' that allows unauthentic
Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability known as 'ProxyLogon' that allows
Microsoft Exchange Server contains a privilege escalation vulnerability in the PowerShell backend that allows authentica
Microsoft Exchange Server allows post-authentication arbitrary file write that enables web shell deployment, the primary
Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is rem
Microsoft Exchange Server Information Disclosure Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is re
Microsoft Exchange Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is re
Microsoft Exchange Server allows authenticated attackers to write arbitrary files to the server filesystem, the third co
Remote code execution in Microsoft Exchange Server 2013, 2016, and 2019 allows authenticated attackers to execute arbitr
Microsoft Exchange Server Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely explo
Microsoft Exchange Server Unified Messaging service contains a deserialization vulnerability that allows authenticated a
Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is rem
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today