CVE-2026-45502

Imagine your Exchange server as a mail-sorting station that’s supposed to only look up information in specific places. This flaw lets someone with limited access trick the station into making “look up” requests to other locations on the network. That can cause the station to accidentally reveal sensitive information it shouldn’t share.

This matters if you run Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, or Microsoft Exchange Server Subscription Edition RTM (including Subscription Edition builds that match the affected lines). Because the attacker needs low-level privileges and no user clicking is involved, the risk is mainly about whether an attacker could obtain those low privileges inside your environment.

Reachability depends on having a way to reach the vulnerable Exchange functionality with an authorized attacker’s low-level access; it’s not described as necessarily reachable from the public internet by default.

This is marked RED because the flaw enables an attacker to extract sensitive data over the network once they have low-level access, and SSRF-style issues often translate into real-world leakage. There is no dated public exploitation claim in the findings, but the risk still warrants immediate patching since it targets a core email system and the fix is available.

1. Confirm which Exchange line you run:

   • Determine your Exchange Server edition and cumulative update level.
   • Compare your version against the affected set in the findings: Exchange Server 2016 Cumulative Update 23; Exchange Server 2019 Cumulative Update 14; Exchange Server 2019 Cumulative Update 15; Microsoft Exchange Server Subscription Edition RTM / Subscription Edition.

2. Check for the fixed versions:

   • Exchange Server 2016 Cumulative Update 23 → fixed in 15.01.2507.069
   • Exchange Server 2019 Cumulative Update 14 → fixed in 15.02.1544.041
   • Exchange Server 2019 Cumulative Update 15 → fixed in 15.02.1748.046
   • Microsoft Exchange Server Subscription Edition RTM / Subscription Edition → fixed in 15.02.2562.043

3. Upgrade plan (recommended):

   • Apply Microsoft’s update guidance for CVE-2026-45502 from the Microsoft Security Response Center (MSRC) update guide.
   • Schedule downtime/maintenance windows as required by your organization’s Exchange patching process.

4. Validate after patching:

   • Confirm Exchange services are operating normally.
   • Review logs for unusual outbound requests or unexpected network destinations initiated by Exchange during the exposure window (and after the patch, ensure the behavior stops).

5. If patching must be delayed:

   • Reduce the number of accounts that can reach Exchange features with “low-level privileges.”
   • Tighten access controls around Exchange administrative/operational roles so low-privileged users cannot use the affected functionality.
   • Restrict outbound network access from the Exchange server where feasible (firewall/proxy rules) to limit possible “arbitrary location” request destinations.

6. Monitoring:

   • Watch for evidence of sensitive data access patterns consistent with information disclosure attempts.
   • Keep an eye on any alerts indicating anomalous server-to-server or server-to-external network connections originating from the Exchange host.

CISA KEV: This CVE is not listed in the CISA KEV findings, so there is no KEV-driven public due date provided by the findings.

Severity in the findings is “RED” despite a medium CVSS score, because exploitation can lead to information disclosure without user interaction. The underlying weakness is SSRF (CWE-918): an authorized attacker with low-level privileges can coerce Microsoft Exchange Server into making server-side requests to attacker-influenced locations, and those responses can disclose sensitive information over the network.

Findings indicate no clear dated press exploitation claim, no incidents reported, and no public exploit code on record. KEV is not listed. EPSS is predicted (trend: flat), but this is informational only and does not override KEV/news status (no KEV/news exploitation confirmation is present in the findings). The finding “actor: Nightmare Eclipse” appears in PULSE as press attention/roundup context, not as confirmed exploitation details in the findings.