What is the CVSS score of CVE-2026-24303?

CVE-2026-24303 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Microsoft Partner Center are affected by CVE-2026-24303?

Microsoft Partner Center contains a critical privilege escalation vulnerability (CVE-2026-24303) that permits low-privileged user accounts to gain unauthorized access to other organizations'…. A patch is available.

How to fix or mitigate CVE-2026-24303?

Within 24 hours, identify and inventory all Microsoft Partner Center user accounts, prioritize low-privileged accounts for investigation, and contact Microsoft support to confirm patch availability and deployment procedures. Within 7 days, deploy the available Microsoft Partner Center security patch to all instances in your environment and verify successful application per vendor advisories; additionally, enable enhanced audit logging for all Partner Center access and privilege changes during this period. Within 30 days, review Partner Center access logs and audit trails for any evidence of unauthorized privilege escalation or cross-tenant access since the vulnerability announcement, implement role-based access control restrictions to enforce least-privilege principles, and reset Partner Center credentials for all users as a precautionary measure.

Microsoft Partner Center CVE-2026-24303

EUVD-2026-25303 CRITICAL

Improper Access Control (CWE-284)

2026-04-23 microsoft

GHSA-59wx-rpwf-57h6

Microsoft Authentication Bypass Microsoft Partner Center

9.6

CVSS 3.1 · NVD

Temporal: 8.3

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CIRCL (temporal)

8.3 HIGH

cvss

vuln.today AI

9.6 CRITICAL

Authenticated low-priv partner user (PR:L) exploits a network-reachable authorization flaw crossing tenants (S:C) with high confidentiality/integrity but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:34 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 22:15 euvd

EUVD-2026-25303

Patch released

Apr 23, 2026 - 22:15 nvd

Patch available

CVE Published

Apr 23, 2026 - 21:37 nvd

CRITICAL 9.6

DescriptionCVE.org

Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Partner Center allows an authenticated, low-privileged user to elevate their access over the network due to improper access control (CWE-284), crossing a security boundary (CVSS scope-changed, 9.6). With confidentiality and integrity impact rated High and a scope change, a successful attacker can reach data or functions belonging to other tenants or higher privilege levels within the Partner Center platform. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC lists exploitation status as none.

Technical ContextAI

Microsoft Partner Center is Microsoft's cloud-hosted portal and API platform used by partners to manage customer tenants, subscriptions, licensing, and Cloud Solution Provider (CSP) relationships. The flaw is classified as CWE-284 (Improper Access Control), meaning the service fails to correctly enforce authorization checks on a network-reachable operation, so a user who is legitimately authenticated at one privilege level can perform actions reserved for a higher level or another boundary. The single CPE, cpe:2.3:a:microsoft:microsoft_partner_center, confirms this is the Partner Center application/service itself rather than an on-premise product, so exploitation targets Microsoft's multi-tenant cloud service. The scope-changed CVSS metric (S:C) indicates the vulnerable authorization component and the impacted resources are different security authorities - consistent with a partner-to-tenant or tenant-to-tenant boundary being bypassed.

RemediationAI

Because Microsoft Partner Center is a Microsoft-operated cloud service, the primary remediation is Patch available per vendor advisory: Microsoft has released a fix through MSRC (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24303), and for a SaaS platform this fix is applied service-side by Microsoft, so most customers require no installation step. No exact fix version is published because the product is not version-tagged. As compensating and detective controls, organizations should review Partner Center role assignments and remove unnecessary low-privilege accounts (reducing the pool of potential authenticated attackers), enforce MFA and Conditional Access on all Partner Center and CSP admin accounts, audit partner/tenant delegated-admin (GDAP/DAP) relationships and revoke stale ones, and monitor Partner Center and Azure AD/Entra sign-in and audit logs for unexpected privilege changes or cross-tenant activity; the trade-off is administrative overhead and possible disruption to legitimate delegated-admin workflows.