CVE-2026-45503: Microsoft Exchange Server Information Disclosure Vulnerability

Synopsis

Server-side request forgery (SSRF) in Microsoft Exchange Server allows an authenticated attacker to make the server issue HTTP requests to internal or external resources on the attacker's behalf. The vulnerability is reachable over the network and requires only a low-privilege account; no victim interaction is needed. Successful exploitation discloses sensitive information and enables tampering with data accessible to the Exchange server process. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Exchange Server over the network; the service must be accessible from the attacker's position on the internet or internal network.

• AuthenticationRequired

  A low-privilege Exchange account is sufficient; no administrator or elevated role is needed, but the attacker must have valid credentials.

• Victim interactionNot required

  The attacker does not need any user or administrator to take an action; exploitation is fully attacker-driven.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or non-standard environmental setup.

Blast Radius

• Reads internal network responses that Exchange would not normally expose, potentially surfacing internal hostnames, IP addresses, service banners, or credential material from backend systems.
• Tampers with or forges requests to internal services reachable by the Exchange server process, which can alter data or trigger unintended state changes in those systems.
• Enables reconnaissance of internal infrastructure by bouncing requests through the Exchange server to probe otherwise firewalled services.