CVE-2026-65801
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
Server-side request forgery (SSRF) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
Risk Assessment
Risk of unauthorized access to internal resources and privilege escalation in the Exchange environment.
Recommendation
Apply security patches from Microsoft and restrict outbound network traffic from Exchange servers.
Other vulnerabilities in Microsoft Exchange Online
See all- CVE-2026-56191Critical
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-48582Critical
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
- CVE-2026-48579Critical
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
- CVE-2026-96185High
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
- CVE-2026-54998High
A vulnerability in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network due to incorrect authorization.
Original NVD description (English source)
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS