CVE-2026-45504: Microsoft Exchange Server SSRF Vulnerability

CVE-2026-45504 Overview

CVE-2026-45504 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server. An authenticated attacker can abuse the flaw to elevate privileges across the network. The weakness is tracked under CWE-918: Server-Side Request Forgery.

Exchange Server processes attacker-controlled URLs without sufficient validation, allowing the server to issue requests to internal resources on behalf of the attacker. Because Exchange typically holds elevated trust within Active Directory environments, SSRF abuse can translate directly into privilege escalation. Microsoft published advisory details in the Microsoft Security Update Guide.

Critical Impact
Authenticated attackers can coerce Exchange Server into issuing internal requests that escalate privileges and compromise the confidentiality, integrity, and availability of mailbox infrastructure.

Affected Products

Microsoft Exchange Server (versions as defined in the Microsoft Security Update Guide)
On-premises Exchange deployments exposing authenticated endpoints
Hybrid Exchange configurations interacting with Microsoft 365

Discovery Timeline

2026-06-09 - CVE-2026-45504 published to the National Vulnerability Database
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45504

Vulnerability Analysis

The vulnerability resides in Exchange Server request-handling logic that fetches resources based on attacker-influenced input. An authenticated user with low privileges can submit crafted requests that cause the server to initiate outbound or internal HTTP calls. These requests inherit the trust of the Exchange service account, providing an attacker with access to resources that should not be reachable from their own session.

SSRF in a mail server context is significant because Exchange interacts with Active Directory, internal autodiscover endpoints, and management APIs. By directing the server to resources behind perimeter controls, an attacker can read or trigger actions associated with higher-privileged identities. The resulting privilege escalation impacts mailbox data, transport rules, and identity trust boundaries.

Root Cause

The root cause is improper validation of user-supplied URLs or hostnames in server-side request flows [CWE-918]. The application accepts destination targets without verifying whether they reference internal-only services, loopback addresses, or sensitive metadata endpoints. Without a strict allowlist and protocol filter, Exchange acts as a confused deputy.

Attack Vector

Exploitation requires network access and authenticated, low-privileged credentials. No user interaction is needed. The attacker submits a request containing a manipulated URL parameter that Exchange resolves and fetches. The server then returns the response or triggers a side effect that the attacker leverages to obtain higher privileges within the directory environment.

No verified public exploit code is available. Refer to the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-45504

Indicators of Compromise

Unexpected outbound HTTP or HTTPS requests originating from the Exchange Server service account to internal IP ranges or loopback addresses.
Exchange IIS logs containing unusual URL parameters referencing internal hostnames, 169.254.169.254, or non-standard schemes such as file:// or gopher://.
Authentication events from the Exchange machine account against directory services or internal APIs that fall outside baseline behavior.

Detection Strategies

Inspect IIS and Exchange HttpProxy logs for crafted query strings targeting URL-handling endpoints used by Autodiscover, EWS, or OWA.
Correlate authenticated user sessions with outbound network connections made by w3wp.exe to identify SSRF pivots.
Apply detections aligned with MITRE ATT&CK techniques T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).

Monitoring Recommendations

Forward Exchange IIS, HttpProxy, and Windows security logs to a centralized analytics platform for correlation.
Baseline outbound traffic from Exchange servers and alert on deviations toward internal management subnets.
Monitor for newly added mailbox permissions, role assignments, or transport rules following suspicious authenticated sessions.

How to Mitigate CVE-2026-45504

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-45504 to all on-premises Exchange Servers.
Restrict access to Exchange administrative endpoints to trusted management networks only.
Rotate credentials and review privileged role assignments if exploitation is suspected.

Patch Information

Microsoft addresses CVE-2026-45504 through cumulative and security updates documented in the Microsoft Security Update Guide. Administrators should identify the Exchange Server cumulative update level in their environment and install the corresponding security update package. Post-patch verification through Get-ExchangeServer and the Exchange Health Checker is recommended.

Workarounds

Limit Exchange Server egress traffic with host-based and network firewalls to block requests to internal management ranges and cloud metadata services.
Enforce Extended Protection for Authentication on Exchange virtual directories to reduce abuse paths.
Require multi-factor authentication for all mailbox accounts to raise the cost of acquiring the authenticated foothold needed for exploitation.

bash

# Example: restrict Exchange egress to internal metadata services on Windows Firewall
New-NetFirewallRule -DisplayName "Block Exchange to Metadata" \
  -Direction Outbound \
  -Program "C:\Windows\System32\inetsrv\w3wp.exe" \
  -RemoteAddress 169.254.169.254 \
  -Action Block