CVE-2026-65801: Microsoft Exchange Online Elevation of Privilege Vulnerability
Published Aug 20, 2026
·Updated
Microsoft Exchange Online Elevation of Privilege Vulnerability
Other sources
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
2 affected components
Microsoft Exchange Online
Microsoft Exchange Online
Event History
Aug 20, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·09:43 PM
Data Sourced
via MITRE·09:43 PM
DescriptionSeverity
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attack can be performed over a network and requires no prior privileges or user interaction. The reported attack complexity is low.
2
What is the potential impact if exploitation succeeds?
Successful exploitation may allow privilege elevation and has reported high impact to confidentiality, integrity, and availability. The scope is rated as changed, indicating the impact may extend beyond the initially affected security authority.
3
Is active exploitation known to be occurring?
The provided exploit-code maturity rating is unproven. It does not establish that active exploitation is occurring.