Summary
Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What is the nature of the spoofing?
An authenticated attacker could cause an affected Exchange server to send HTTP requests to internal or loopback systems by submitting a specially crafted internet calendar subscription. Successful exploitation could expose sensitive information returned as valid calendar content from resources reachable by the server.
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated using valid Exchange user credentials.
Security updates
15.02.1544.046 — https://support.microsoft.com/help/5121610
15.02.1748.051 — https://support.microsoft.com/help/5121609
15.01.2507.073 — https://support.microsoft.com/help/5121611
15.02.2562.049 — https://support.microsoft.com/help/5121608
Vulnerabilities 1
-
Medium 6.5
Microsoft Exchange Server Spoofing Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-69361 Microsoft Exchange Server Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69361
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss