CVE-2026-69361: Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
Other sources
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.049Patch KB5121608 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.073Patch KB5121611 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.051Patch KB5121609 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.046Patch KB5121610
Event History
Frequently Asked Questions
Which Exchange Server deployments are affected?
The affected products listed are Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, and Microsoft Exchange Server Subscription Edition RTM.
What access does an attacker need to exploit this issue?
The attacker must already be authorized and can exploit the vulnerability remotely over a network. No user interaction is required.
What is the potential impact?
Successful exploitation allows spoofing through a server-side request forgery condition. The supplied severity vector indicates high confidentiality impact, with no integrity or availability impact indicated.