Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An authenticated Outlook Web App user could exploit this issue by reusing a valid access token issued to their own mailbox to access attachments stored in another user’s mailbox within the same Exchange organization, without authorization.
What type of information could be disclosed by this vulnerability?
An attacker could gain unauthorized access to email attachments stored in other users’ mailboxes within the same organization, which may include documents, images, or other files attached to emails.
Security updates
15.01.2507.071 — https://support.microsoft.com/help/5103215
15.02.2562.045 — https://support.microsoft.com/help/5103212
15.02.1748.048 — https://support.microsoft.com/help/5103213
15.02.1544.043 — https://support.microsoft.com/help/5103214
Vulnerabilities 1
-
High 8.1
Microsoft Exchange Server Information Disclosure Vulnerability
Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-45503 Microsoft Exchange Server Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45503
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss