This vulnerability (CVE-2026-45504) involves SSRF in Microsoft Exchange Server 2016 Cumulative Update 23, enabling an attacker with some level of authorization to perform server-side request forgery attacks that can lead to privilege escalation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix addressing this issue.

An authorized attacker can exploit this SSRF vulnerability to elevate their privileges on the affected Microsoft Exchange Server 2016 Cumulative Update 23 instance. This can lead to full compromise of confidentiality, integrity, and availability of the system.

Apply the official fix provided by Microsoft for this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45504 for detailed patching instructions. Since an official fix is available, remediation should be prioritized to prevent exploitation.