This vulnerability is a server-side request forgery that enables an attacker already authenticated to the Exchange Server with limited privileges to gain higher privileges. The single flaw allows the attacker to instruct the server to issue requests on its behalf, which can lead to unauthorized access, data extraction, or further compromise of the Exchange infrastructure.

Microsoft Exchange Server 2016 cumulative update 23, Microsoft Exchange Server 2019 cumulative update 14, Microsoft Exchange Server 2019 cumulative update 15, and Microsoft Exchange Server Subscription Edition RTM are affected.

The CVSS score of 8.8 indicates a high severity with potential for full privilege escalation. While the EPSS score is not available, the vulnerability is exploitable remotely over the network by an authorized user. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS suggests a significant risk, especially in environments where privileged accounts are not properly segregated.