This vulnerability (CVE-2026-45502) in Microsoft Exchange Server 2016 Cumulative Update 23 is classified as CWE-918 (Server-Side Request Forgery). It enables an attacker with authorized access to cause the server to make unintended requests, potentially disclosing information over the network. The CVSS 3.1 base score is 5.0, reflecting medium severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An authorized attacker can exploit this SSRF vulnerability to disclose information over the network. The impact is limited to information disclosure (confidentiality loss) without integrity or availability impact. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45502 to remediate this vulnerability.