This vulnerability (CWE-285) in Microsoft Exchange Server 2016 Cumulative Update 23 arises from improper authorization controls. An attacker with some level of authorization can exploit this flaw to disclose information over the network. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information, potentially compromising confidentiality. The integrity and availability of the system are not impacted. The attacker must have some level of authorization to exploit this issue, but no user interaction is needed.

An official fix is available from Microsoft. Users of Microsoft Exchange Server 2016 Cumulative Update 23 should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45503 to remediate this vulnerability.