This vulnerability (CVE-2026-45501) in Microsoft Exchange Server 2016 Cumulative Update 23 is classified as CWE-918 (Server-Side Request Forgery). It enables an attacker with authorized access to cause the server to make forged requests over the network. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact but no integrity or availability impact. Microsoft has published an official fix to address this issue.

An authorized attacker can exploit this SSRF vulnerability to perform spoofed network requests, potentially leading to unauthorized information disclosure. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501 to remediate this vulnerability.