{"schemaVersion":3,"id":"CVE-2026-45501","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.","dates":{"published":"2026-06-09T17:04:45.533Z","modified":"2026-09-24T13:43:47.304Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00457,"percentile":0.38611,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.14900000000000005,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00308},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00457,"percentile":0.38611}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00308,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00457,"percentile":0.38611}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-918","name":"Server-Side Request Forgery (SSRF)","description":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/918.html"},{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"microsoft","product":"exchange_server","name":"Exchange Server","label":"exchange_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2016:cumulative_update_23","noFixRecorded":false,"fixedIn":null},{"text":"2019:cumulative_update_14","noFixRecorded":false,"fixedIn":null},{"text":"2019:cumulative_update_15","noFixRecorded":false,"fixedIn":null}],"versionsText":"2016:cumulative_update_23 | 2019:cumulative_update_14 | 2019:cumulative_update_15","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"msexchange","label":"Microsoft Exchange","category":"server-app"}},"hubHref":"/vendor/microsoft/exchange_server"},{"vendor":"microsoft","product":"exchange_server_subscription_edition","name":"exchange server subscription edition","label":"exchange_server_subscription_edition","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 15.02.2562.043","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 15.02.2562.043","eol":null,"hubHref":"/vendor/microsoft/exchange_server_subscription_edition"},{"vendor":"microsoft","product":"microsoft exchange server 2016 cumulative update 23","name":"Microsoft Exchange Server 2016 Cumulative Update 23","label":"microsoft exchange server 2016 cumulative update 23","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.01.0.0, < 15.01.2507.071","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.01.0.0, < 15.01.2507.071","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2016_cumulative_update_23"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 14","name":"Microsoft Exchange Server 2019 Cumulative Update 14","label":"microsoft exchange server 2019 cumulative update 14","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.02.0.0, < 15.02.1544.043","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.02.0.0, < 15.02.1544.043","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2019_cumulative_update_14"},{"vendor":"microsoft","product":"microsoft exchange server 2019 cumulative update 15","name":"Microsoft Exchange Server 2019 Cumulative Update 15","label":"microsoft exchange server 2019 cumulative update 15","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.02.0.0, < 15.02.1748.048","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.02.0.0, < 15.02.1748.048","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_2019_cumulative_update_15"},{"vendor":"microsoft","product":"microsoft exchange server subscription edition rtm","name":"Microsoft Exchange Server Subscription Edition RTM","label":"microsoft exchange server subscription edition rtm","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 15.02.0.0, < 15.02.2562.045","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 15.02.0.0, < 15.02.2562.045","eol":null,"hubHref":"/vendor/microsoft/microsoft_exchange_server_subscription_edition_rtm"}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501","label":"msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501","hostname":"msrc.microsoft.com","tags":["Vendor Advisory","Patch"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-06-09T17:04:45.533Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-24T13:43:47.304Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T16:22:18.456Z","stale":false,"partial":false}}