This vulnerability (CVE-2026-45501) in Microsoft Exchange Server 2016 Cumulative Update 23 involves server-side request forgery (CWE-918). It enables an attacker with authorized access to cause the server to make forged requests over the network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this SSRF vulnerability to perform spoofing over a network, potentially leading to unauthorized access to sensitive information due to the high confidentiality impact. There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

An official fix is available from Microsoft. Users should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501 to remediate this vulnerability.