CVE-2026-65813 is a medium severity (CVSS 6.5) server-side request forgery in Microsoft Exchange Server. Microsoft lists fixes for Exchange Server Subscription Edition, Exchange 2019 CU14 and CU15, and Exchange 2016 CU23. Install the update that matches your build.
What's affected
The record describes server-side request forgery (CWE-918) in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over a network. It lists Exchange Server and Exchange Server Subscription Edition.
Microsoft's update guide gives these fixes:
- Exchange Server Subscription Edition RTM: KB5121573, build 15.02.2562.046
- Exchange Server 2019 Cumulative Update 15: KB5121574, build 15.02.1748.049
- Exchange Server 2019 Cumulative Update 14: KB5121575, build 15.02.1544.044
- Exchange Server 2016 Cumulative Update 23: KB5121576, build 15.01.2507.072
Microsoft scores it 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. That vector shows confidentiality impact only, with no integrity or availability impact. The record's phrase "elevate privileges" is the title wording, and the vector is the better guide to the actual impact.
How to check if you're exposed
Read the build number on each Exchange server and compare it with the list above. In the Exchange Management Shell:
Get-ExchangeServer | Format-List Name,AdminDisplayVersion
If a server runs an older cumulative update than the ones named above, it needs to move up before the fix can apply. Exchange updates are cumulative, so check that your CU level is one Microsoft still supports.
Attackers need a low privilege account, so mailbox users and compromised mailboxes both count. Exposure rises where Exchange is reachable from the internet through Outlook on the web or other published endpoints.
What to do now
- Record the build of every Exchange server.
- Install the fixed update for your cumulative update level, starting with internet facing servers.
- Follow the install instructions in Microsoft's KB article and restart as needed.
- Review outbound traffic from Exchange servers to internal addresses that they have no reason to call.
- Check that the CU level you run is still supported.
Why it matters
Server side request forgery tricks a server into making a request on the attacker's behalf. The request leaves from the server, so it can reach internal services and metadata addresses that an outside client cannot. The result is often disclosure of data from those internal places.
That fits the vector here, which rates only confidentiality as high. A low privilege account is enough to start. Exchange also sits in a trusted network position, which raises the value of any request it can be made to send.
Microsoft marks it as not publicly disclosed and not exploited at release, with exploitation less likely. The record's KEV flag is false.
Quick check
Do I need to patch if Exchange is only internal?
Yes, though the risk is lower. The attacker needs an authenticated account, and internal compromises still happen.
Which build is fixed on Exchange 2019?
Microsoft lists KB5121574 for CU15 and KB5121575 for CU14, with builds 15.02.1748.049 and 15.02.1544.044.
Sources
- Microsoft Security Response Center update guide entry for CVE-2026-65813
- NVD record for CVE-2026-65813
Last reviewed: 18 October 2026.
