This vulnerability (CVE-2026-45501) involves server-side request forgery (CWE-918) in Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0). An authorized attacker can exploit this flaw to perform spoofing over a network. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. Microsoft has published an official fix for this issue.

The vulnerability allows an authorized attacker to perform server-side request forgery, enabling spoofing over the network. This could potentially lead to unauthorized network requests being made from the Exchange Server, impacting confidentiality. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

An official fix is available from Microsoft. Users should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501. No additional mitigation steps are indicated by the vendor.