Server-Side Request Forgery (SSRF) in Microsoft Exchange Server - CVE-2026-69361
Published: September 8, 2026
Vulnerability identifier: #VU147627
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-69361
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to server-side request forgery (ssrf) in Microsoft Exchange Server when processing a specially crafted internet calendar subscription. A remote user can submit a specially crafted internet calendar subscription to disclose sensitive information.
The affected server can be induced to send HTTP requests to internal or loopback systems.
Affected software
Microsoft Exchange Server
How to mitigate CVE-2026-69361
Install security update from vendor's website.
Microsoft Exchange Server - addressed in versions SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051