CVE-2026-45504: Microsoft Exchange Server Elevation of Privilege Vulnerability

Synopsis

Server-side request forgery (SSRF) in Microsoft Exchange Server allows an authenticated attacker to escalate their privileges over the network. The vulnerability is reachable remotely and requires only a low-privilege account; no victim interaction is needed. Successful exploitation gives the attacker high levels of read, write, and availability impact on the Exchange server. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected build.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Exchange Server service over the network; AV:N means no local or physical access is needed.

• AuthenticationRequired

  A valid low-privilege account on the Exchange Server is sufficient; PR:L means anonymous access alone does not satisfy this requirement.

• Victim interactionNot required

  The attacker does not need any user or administrator to click a link or take any action; UI:N means exploitation is fully attacker-driven.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites.

Blast Radius

• A successful attacker reads sensitive Exchange data, including stored emails, configuration secrets, and authentication material.
• The attacker writes to or modifies Exchange data, including mailbox contents, transport rules, and server configuration.
• The attacker can disrupt Exchange service availability, causing mail flow outages for affected users.
• Because all three impact dimensions (confidentiality, integrity, availability) are rated HIGH, a single exploited instance provides full operational control over the affected Exchange server.