The flaw is a server‑side request forgery that enables an attacker with authorized access to send arbitrary HTTP requests from the Exchange server to internal resources, thereby revealing sensitive data. This vulnerability falls under CWE‑918 and primarily leads to unauthorized disclosure of confidential information.

Affected products include Microsoft Exchange Server 2016 receiving Cumulative Update 23, Microsoft Exchange Server 2019 receiving Cumulative Updates 14 and 15, and Microsoft Exchange Server Subscription Edition in its release‑to‑market version. These variants are vulnerable until the corresponding update is applied.

The CVSS score of 5.0 indicates a medium severity disclosure. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting no known widespread exploitation. The attacker must be authorized on the Exchange system to perform SSRF; thus the likely attack vector is via authenticated user privileges or compromised credentials within the Exchange infrastructure.