Microsoft Exchange Online EUVD-2026-63689

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions - remote unauthenticated exploitation over the network against Microsoft Exchange Online with low complexity and no user interaction. The description names server-side request forgery as the mechanism, so exploitation requires the attacker to supply or influence a request target that the Exchange Online service then fetches server-side. The principal limiting factor is not a customer configuration but the deployment model: Exchange Online is operated and patched by Microsoft, so the realistic exploitation window is confined to the period before Microsoft's centralized fix; customers cannot independently harden or expose the service, and no on-premises setting is involved.

The signals are largely consistent and point to genuine high priority: CVSS 3.1 base is the maximum 10.0 with AV:N/AC:L/PR:N/UI:N, meaning remote, unauthenticated, low-complexity exploitation, plus S:C and C:H/I:H/A:H. However, several real-world-risk signals are absent from the input: no EPSS probability, no SSVC decision data, and no KEV entry, so there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' A key mitigating fact not captured by CVSS is that Exchange Online is a Microsoft-operated cloud service, so the fix is applied centrally by the vendor and individual customers generally cannot be exploited once Microsoft has patched. The maximal CVSS therefore reflects worst-case pre-patch severity rather than ongoing customer-side exposure; treat it as high-severity-but-vendor-remediated rather than an urgent customer patch scramble.

A remote, unauthenticated attacker sends a crafted request to an Exchange Online endpoint that causes the service to fetch an attacker-specified URL from within Microsoft's trusted network, reaching an internal service or credential endpoint not exposed externally. Because the forged request runs in a privileged context and crosses a trust boundary (scope change), the attacker can obtain sensitive internal data or tokens to elevate privileges. No public proof-of-concept is identified at time of analysis, and the low attack complexity means no special timing or configuration would be needed if exploited.