Server-Side Request Forgery in Microsoft Exchange Online
CVE-2026-65801

10CRITICAL

Key Information:

Vendor

Microsoft
Status
Microsoft Exchange Online
Vendor
CVE Published:
20 August 2026

What is CVE-2026-65801?

A server-side request forgery (SSRF) vulnerability in Microsoft Exchange Online enables an unauthorized attacker to make malicious requests to internal network resources. By exploiting this vulnerability, attackers can gain access to sensitive data and potentially escalate their privileges within the network. This compromise can lead to further security breaches and unauthorized actions within the environment.

Affected Version(s)

Microsoft Exchange Online -

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.