Microsoft Exchange SSRF Vulnerability Lets Low-Privileged Attackers Read Arbitrary Files

A critical server-side request forgery (SSRF) vulnerability (CVE-2026-45504, CVSS 8.8) in Microsoft Exchange Server 2019's WOPI/OneDriveProUtilities allows authenticated low-privileged users to supply a malicious WebApplicationUrl (including file:// URIs) that causes Exchange to perform file reads on the local filesystem. The report includes code excerpts showing unsafe use of attacker-controlled URLs, a public PoC demonstrating extraction of sensitive files, and recommends strict URL scheme validation, monitoring EWS attachment activity, and prioritizing patches for on-prem Exchange deployments.