Account
CVE-2026-21264
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with XSS payload
-
DeliverySend link to Microsoft Account user
-
ExploitUser clicks link in browser
-
ExecutionJavaScript executes in victim's session context
-
ImpactAttacker steals credentials or impersonates user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Microsoft Account web application must reflect unsanitized user input in HTML response. Requires user interaction (UI:R) to click attacker-controlled link. No authentication required. Works against default Microsoft Account configurations. |
| Impact | CVSS 9.3 — Microsoft Account is the central authentication for all Microsoft services (Azure, Office 365, Outlook, Xbox). XSS here could steal session tokens with access to the entire Microsoft ecosystem. |
| Exploit ScenarioDerived | An attacker crafts a link exploiting the XSS in Microsoft Account. When a victim clicks it, the injected script steals their Microsoft session tokens, giving the attacker access to Azure subscriptions, Office 365 email, OneDrive files, and all connected services. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Microsoft Account has a cross-site scripting vulnerability allowing unauthenticated attackers to execute scripts in the context of Microsoft Account pages.
Earlier versions of this analysis (1)
XSS in Microsoft Account enables session hijacking and credential theft.
RemediationAI
Microsoft has released patches. Ensure browser and Microsoft services are up to date.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Account has a CWE-79 XSS vulnerability that allows unauthenticated attackers to inject malicious scripts through crafted input that executes in victims' browsers when viewing Microsoft Account pages.
Know when Account gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.
Executive ViewAI
A critical cross-site scripting vulnerability in Microsoft Account systems could allow attackers to impersonate users and gain unauthorized access to organizational accounts and data. This poses an immediate threat to all employees and systems relying on Microsoft authentication, requiring urgent defensive action until a patch is released.
Deploy Web Application Firewall (WAF) rules to detect and block XSS attack patterns; enforce Multi-Factor Authentication (MFA) on all Microsoft Account-dependent systems; implement Content Security Policy (CSP) headers; restrict Microsoft Account login to corporate VPN/zero-trust networks; disable legacy authentication protocols; enhance email filtering for account compromise indicators; deploy behavioral analytics to detect anomalous account activity; segment critical systems from general network access; maintain enhanced logging and monitoring of authentication events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android
Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_tok
Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access
Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version
Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5
Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior
Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior
Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prio
Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account pr
A security vulnerability in Samsung Account (CVSS 4.0) that allows local attacker. Remediation should follow standard vu
Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local
Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to acc
GitHub PoC
Exploit-DB