CVE-2026-45502

Imagine your Exchange server as a mail-sorting station that’s supposed to only look up information in specific places. This flaw lets someone with limited access trick the station into making “look up” requests to other locations on the network. That can cause the station to accidentally reveal sensitive information it shouldn’t share.

This matters if you run Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, or Microsoft Exchange Server Subscription Edition RTM (including Subscription Edition builds that match the affected lines). Because the attacker needs low-level privileges and no user clicking is involved, the risk is mainly about whether an attacker could obtain those low privileges inside your environment.

Reachability depends on having a way to reach the vulnerable Exchange functionality with an authorized attacker’s low-level access; it’s not described as necessarily reachable from the public internet by default.

This is marked RED because the flaw enables an attacker to extract sensitive data over the network once they have low-level access, and SSRF-style issues often translate into real-world leakage. There is no dated public exploitation claim in the findings, but the risk still warrants immediate patching since it targets a core email system and the fix is available.