This vulnerability, identified as CWE-918 (Server-Side Request Forgery), affects Microsoft Exchange Online. It enables an attacker without privileges to perform SSRF attacks that can lead to privilege escalation across the network. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to address this issue.

Successful exploitation allows an unauthorized attacker to elevate privileges within the Microsoft Exchange Online environment, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 10, indicating maximum severity.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft security update guide for CVE-2026-65801. Since this is not a cloud service vulnerability, remediation requires applying the vendor's update. No additional mitigation steps are specified by the vendor advisory.