CVE-2026-45504

Microsoft Exchange Server is the system many businesses use to run email inside and outside the company. This bug can let someone who already has a small foothold inside Exchange use it to gain much higher control—like going from “limited staff account” to “admin,” with no need for a user to click anything. That higher control can lead to exposure of sensitive email data and can also disrupt the service.

This matters if you run Microsoft Exchange Server (including Exchange Server Subscription Edition, or Exchange Server 2016 Cumulative Update 23, or Exchange Server 2019 Cumulative Update 14/15). The vulnerability requires low-level access (not full admin) and can be triggered over the network without any user interaction. Because the exact “reachable in default config” and other preconditions aren’t confirmed in the provided findings, treat it as relevant whenever an attacker could reach Exchange and have low-level access to leverage the issue.

This is urgent because it enables an attacker with low-level access to escalate privileges over the network, and Microsoft Exchange is a high-value target for attackers. Even though there’s no confirmed public exploit code in the findings, the combination of network reachability and privilege escalation makes it a serious risk for businesses running Exchange. Patch as a RED priority.

1. Confirm your Exchange product and build:
   • Determine whether you’re running Exchange Server (including Exchange Server Subscription Edition or Exchange Server Subscription Edition RTM) and identify the exact installed build number.
2. Compare against the fixed versions:
   • Exchange Server Subscription Edition: fixed in 15.02.2562.043
   • Exchange Server 2016 Cumulative Update 23: fixed in 15.01.2507.069
   • Exchange Server 2019 Cumulative Update 14: fixed in 15.02.1544.041
   • Exchange Server 2019 Cumulative Update 15: fixed in 15.02.1748.046
     If your build is earlier than the corresponding fixed version, you’re considered exposed based on the provided patch mapping.
3. Plan and apply the update:
   • Follow Microsoft’s update guide for CVE-2026-45504: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45504
   • Schedule a maintenance window per your normal Exchange patching process (validate backups and required restart steps as dictated by your environment).
4. If you are delayed on patching:
   • Reduce network exposure to Exchange (only allow required inbound access paths from approved networks).
   • Limit/monitor any accounts that have low-level access to Exchange-related functions and services; remove unused permissions.
5. After upgrading:
   • Re-check the Exchange build number to confirm it matches (or is newer than) the fixed version for your edition.
6. What to monitor while rolling out:
   • Unusual requests or authentication/authorization activity involving Exchange from unexpected sources.
   • Any anomalies in Exchange service behavior that indicate unauthorized attempts to change server behavior or privileges.
7. KEV timing:
   • This CVE is not listed in CISA KEV in the provided findings, so there is no KEV-based due date here; treat the RED patch priority as coming from the risk described in the findings and the importance of Exchange.

CVE-2026-45504 is a Microsoft Exchange Server Elevation of Privilege vulnerability mapped to CWE-918. The findings describe it as an SSRF (Server-Side Request Forgery) issue where an attacker with low-level access can trigger network-based behavior to elevate privileges without user interaction. No CISA KEV listing is provided, and no dated press exploitation claim or public exploit code is listed in the findings; exploitation status is therefore not confirmed by those sources here. The provided risk traffic-light verdict is RED based on the impact potential (confidentiality, integrity, and availability) combined with the privilege escalation mechanism over the network.