CVE-2026-45504 Part 1: Why On-Prem Exchange Is an Active Directory Attack Surface
On-prem Exchange doesn’t sit at the edge of an Active Directory network. It sits near the center of it. Every mailbox-enabled account authenticates against AD, every calendar free/busy lookup and address book query touches AD, and the Exchange servers themselves run as domain-joined machines with service accounts that historically carried far more trust in the domain than the phrase “mail server” suggests. That last part isn’t new or exotic. In 2019, Dirk-jan Mollema published PrivExchange, showing that Exchange’s default install granted its own service accounts WriteDACL rights over the domain object itself, enough that coercing Exchange’s machine account into authenticating to an attacker and relaying that authentication onward was a straight line to Domain Admin. Microsoft has spent years since walking that default back, but the underlying shape of the problem hasn’t changed: Exchange is not a bolt-on app server, it’s a heavily-trusted AD citizen, and a bug in Exchange is frequently a bug in the domain.
This series is about a newer entry in that same category. CVE-2026-45504, patched by Microsoft on June 9, 2026, is a server-side request forgery and arbitrary file read vulnerability in on-prem Exchange Server 2016 and 2019, including Subscription Edition. Part 2 covers the mechanism in detail. What matters for this post is the precondition: exploiting it requires nothing more than an authenticated, low-privilege mailbox account. No admin rights, no prior foothold beyond a working login, no social engineering beyond whatever it took to get that one set of credentials in the first place.
That precondition is why this series exists on this site specifically. Impacket Deep Dive spent ten posts showing how a completely ordinary domain account, svc-legacy-scan, went from a name in a user list to a cracked password. Password Cracking and Wordlist Engineering did the actual cracking. BloodHound Deep Dive mapped what that account’s group memberships and ACLs could reach. Every one of those posts assumed the next step was more Active Directory: Kerberoasting, ACL abuse, lateral movement over SMB. CVE-2026-45504 is a reminder that the next step doesn’t have to stay inside AD at all. A mailbox login is also an Exchange login, and Exchange’s own trust relationship with the rest of the domain means an app-layer bug there can matter as much as anything found with secretsdump.py.
A note on how this series is built, because it’s a real departure from how most offensive-tooling content on this site gets written. Series like Impacket, Password Cracking, Sn1per, and BloodHound were verified by running real tools against a real lab, sandbox, or documented lab domain. Standing up a deliberately unpatched on-prem Exchange server for this one is a materially bigger lift than anything those series needed, and CVE-2026-45504 is recent enough, with a public proof-of-concept already circulating, that the responsible version of this content doesn’t need a live rebuild anyway. So this series follows the model set by an earlier CVE post on this site: the vulnerability facts come from Microsoft’s own advisory and published third-party research, cited directly rather than reproduced as working exploit code, and the credential side of the story reuses transcripts that already ran, for real, earlier on this site. Nothing here is a new how-to for attacking a live Exchange server. It’s an explanation of a real, patched bug, held up against work this blog already did.
Part 2 gets into what CVE-2026-45504 actually does and why the fix took the form it did.