CVE-2026-26137: SSRF in Microsoft Exchange Online

The SSRF vulnerability in Microsoft Exchange Online poses a significant threat. An attacker, already authenticated within the Exchange environment, can craft malicious requests to internal services that are normally inaccessible from the outside. This could involve accessing sensitive data stored on internal databases, interacting with internal APIs to modify configurations, or even leveraging the Exchange server as a proxy to attack other internal systems. The potential blast radius is substantial, as successful exploitation could lead to complete compromise of the Exchange environment and potentially the entire network it resides on. Exploitation could mirror patterns seen in other SSRF vulnerabilities where internal services are inadvertently exposed, leading to data exfiltration or privilege escalation.

1. Reserved2026-02-11
2. Published2026-03-19
3. Modified2026-04-14
4. EPSS updated2026-03-27

Given the lack of a specific fixed version, immediate mitigation is crucial. The primary strategy is to restrict outbound network connections from the Exchange Online environment. Implement strict network segmentation to isolate Exchange servers from sensitive internal resources. Review and harden outbound firewall rules to only allow necessary connections. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to filter malicious requests. Regularly monitor Exchange logs for suspicious outbound requests and unusual network activity. Until a patch is released, carefully evaluate and restrict user permissions within Exchange to minimize the potential impact of a successful attack.