CVE-2026-65801: CWE-918: Server-Side Request Forgery (SSRF) in Microsoft Microsoft Exchange Online

This vulnerability, identified as CVE-2026-65801 and categorized under CWE-918, involves a Server-Side Request Forgery (SSRF) flaw in Microsoft Exchange Online. Exploitation of this flaw enables an unauthorized attacker to elevate privileges remotely without user interaction. The CVSS 3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an attacker to elevate privileges over a network, potentially leading to full compromise of affected Microsoft Exchange Online environments. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

An official fix is available from Microsoft. Administrators should apply the vendor-provided patch promptly to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65801 for detailed remediation instructions.