# CVE-2026-65801: Microsoft Exchange Online server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-65801-microsoft-exchange-online-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65801 · Severity: critical · CVSS 10 · Published 2026-08-20

Microsoft Exchange Online is the cloud-based email and collaboration platform used by millions of organizations worldwide. A server-side request forgery vulnerability allows an attacker to elevate their privileges across the network without authorization, potentially compromising email, calendars, and sensitive business communications for affected users.

Technologies: [Microsoft Exchange Online](https://junglewise.ai/threats/technologies/exchange-online). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-65801 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65801 being exploited in the wild.

**How severe is CVE-2026-65801?** Critical severity, with a CVSS score of 10, published 20 August 2026.

**Which products and versions are affected?** Microsoft Exchange Online.

**Is there a fix for CVE-2026-65801?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65801 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-65801?** Check whether you run Microsoft Exchange Online. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability in Microsoft Exchange Online permits privilege escalation over the network. The vulnerability allows an attacker to forge requests that the Exchange server processes on their behalf, bypassing normal authorization controls. This can be exploited to access restricted resources or perform privileged actions without proper authentication. The attack is network-reachable and does not require prior authentication. Microsoft has released security patches to address this issue.

## Affected products

- Microsoft Exchange Online

## Timeline

- 2026-08-20: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65801](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65801)

## Related threats

- [Microsoft Exchange Online stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-96185-stack-based-buffer-overflow-in-microsoft-exchange-online-allows)
- [Microsoft Exchange Online improper authentication](https://junglewise.ai/threats/cve-2026-56191-microsoft-exchange-online-improper-authentication)
- [Microsoft Exchange Online privilege escalation via incorrect authorization](https://junglewise.ai/threats/cve-2026-54998-microsoft-exchange-online-privilege-escalation-via-incorrect)
- [Microsoft Exchange Online privilege escalation via missing authorization](https://junglewise.ai/threats/cve-2026-48582-microsoft-exchange-online-privilege-escalation-via-missing)
- [Microsoft Exchange Online improper authorization](https://junglewise.ai/threats/cve-2026-48579-microsoft-exchange-online-improper-authorization)