Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-45504 EUVD-2026-35680GHSA-x3fg-4h2p-6mgp

Microsoft Exchange Server Elevation of Privilege Vulnerability

Published Jun 9, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft Exchange Server 2016 Cumulative Update 23 Product: Microsoft Exchange Server 2019 Cumulative Update 14 Product: Microsoft Exchange Server 2019 Cumulative Update 15 Product: Microsoft Exchange Server Subscription Edition RTM

Description

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Affected products

VendorProductAffectedFixed
Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 15.01.0.0 – < 15.01.2507.071 15.01.2507.071
Microsoft Microsoft Exchange Server 2019 Cumulative Update 14 15.02.0.0 – < 15.02.1544.043 15.02.1544.043
Microsoft Microsoft Exchange Server 2019 Cumulative Update 15 15.02.0.0 – < 15.02.1748.048 15.02.1748.048
Microsoft Microsoft Exchange Server Subscription Edition RTM 15.02.0.0 – < 15.02.2562.045 15.02.2562.045

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 4

References