EWS ReferenceAttachment ProviderEndpointUrl Points to External Domain (CVE-2026-45504)

Ethan Andrews@eandrews

•updated Jul 2, 2026•2•0•5

Detects Microsoft Exchange EWS (Exchange.asmx) requests containing a ReferenceAttachment call where the ProviderEndpointUrl parameter points to a non-Microsoft/external domain. This is consistent with SSRF exploitation techniques, such as those observed in CVE-2026-45504, where an attacker-controlled endpoint is provided to Exchange for fetching WOPI properties.