CVE-2026-69361: CWE-918: Server-Side Request Forgery (SSRF) in Microsoft Microsoft Exchange Server 2016 Cumulative Update 23

This vulnerability (CVE-2026-69361) involves SSRF in Microsoft Exchange Server 2016 Cumulative Update 23, enabling an authorized attacker to conduct spoofing over a network. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C, indicating network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact, with official remediation and confirmed fix. The affected versions include multiple builds prior to specific update versions in the 15.01.x.x and 15.02.x.x series.

An authorized attacker can exploit this SSRF vulnerability to perform network spoofing, potentially leading to unauthorized access to sensitive information due to high confidentiality impact. There is no impact on integrity or availability. The vulnerability requires low privileges and no user interaction, making it moderately exploitable within the affected environment.

An official fix is available from Microsoft. Users should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69361 to remediate this vulnerability.