Microsoft Exchange Server Information Disclosure Vulnerability

published 2026-06-09 5 mo ago modified 2026-09-24 45 d ago also EUVD-2026-35678

cvss: 5.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 19.6%; EPSS 19.6% chance of exploitation in 30 days, percentile 97%
public exploits: 0; none known

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

Patch / fix

fixed in 4 links 1

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 15.01.2507.071
Microsoft Microsoft Exchange Server 2019 Cumulative Update 14 15.02.1544.043
Microsoft Microsoft Exchange Server 2019 Cumulative Update 15 15.02.1748.048
Microsoft Microsoft Exchange Server Subscription Edition RTM 15.02.2562.045

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45502 advisory

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 4 mo ago (2026-06-10)

Exploit prediction

19.64% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C
CNA	3.1	5.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected products

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft Microsoft Exchange Server Subscription Edition RTM

Classification

Weakness

CWE-918 Server-Side Request Forgery

Technology feeds

Microsoft Exchange rss critical rss

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2026-45502
vendor-advisory, patch

Sources

CVE List CVE-2026-45502
NVD CVE-2026-45502

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary