CVE-2026-45504

The 'authorized attacker' qualifier in this disclosure creates dangerous false comfort. It implies a contained threat, but in reality it describes the post-compromise phase where Exchange's deep Active Directory integration makes privilege elevation catastrophically useful. In modern enterprise attack chains, 'authorized' encompasses a wide and realistic range of scenarios: a compromised standard user mailbox via phishing, a stolen service account credential, or any initial foothold that grants even minimal Exchange access. The relevant question isn't whether the attacker has legitimate credentials at the start, but what they can do once they have any foothold — and this CVE explicitly answers that with privilege elevation. Exchange occupies a uniquely dangerous position that standard SSRF severity models don't capture. It routinely authenticates to internal services, often runs with elevated domain privileges for mailbox access, and serves as a trust broker between email security and identity infrastructure. An SSRF here isn't just reading internal web pages — it's a potential gateway to the authentication token or service context that Exchange holds. The privilege escalation context is where this CVE's real ambiguity lives. Exchange's service account architecture typically involves MSExchange* service accounts that often hold Exchange Windows permissions and may participate in constrained delegations to back-end mail stores or AD. The critical question for defenders is whether this achieves Exchange-specific admin escalation (EAC access, receive connector abuse, transport agent injection) — severe but contained to mail infrastructure — or crosses into domain privilege via unconstrained delegation or credential relay from the Exchange server's SYSTEM context, which makes this an enterprise-wide compromise trigger. Check immediately whether your Exchange servers have TrustedForDelegation set, whether they participate in any cross-forest trusts, and whether SPNs like http/exchange.contoso.com are registered to service accounts eligible for Kerberoasting or delegation abuse. That mapping determines whether this is a mail-tier incident or an AD compromise trigger. CVSS 8.8 may not reflect the actual blast radius if your Exchange deployment uses legacy service accounts with broad AD privileges and no privileged access management in place.

Reviewed through automated stages and approved by a human before publication.