CVE-2026-65801
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Server-side request forgery (SSRF) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
Risk Assessment
Risk of unauthorized access to internal resources and privilege escalation in the Exchange environment.
Recommendation
Apply security patches from Microsoft and restrict outbound network traffic from Exchange servers.
Other vulnerabilities in Microsoft Exchange Online
See all- CVE-2026-56191Critical
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-48582Critical
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
- CVE-2026-48579Critical
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
- CVE-2026-54998High
A vulnerability in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network due to incorrect authorization.
Original NVD description (English source)
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS