Skip to main content

Microsoft CVE-2026-41103

| EUVDEUVD-2026-29689 CRITICAL
Incorrect Implementation of Authentication Algorithm (CWE-303)
2026-05-12 microsoft GHSA-w9j2-m5wx-fqq4
9.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
ENISA EUVD
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
May 12, 2026 - 16:59 nvd
CRITICAL 9.1

DescriptionCVE.org

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

Analysis

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

CVE-2023-22515 CRITICAL POC
9.8 Oct 04

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited

CVE-2015-5603 MEDIUM POC
6.5 Sep 21

The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java

CVE-2015-8399 MEDIUM POC
4.3 Apr 11

Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName p

CVE-2012-2926 CRITICAL POC
9.1 May 22

Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef

CVE-2014-2314 MEDIUM POC
4.3 Mar 09

Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers t

CVE-2023-22518 CRITICAL POC
9.8 Oct 31

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Rated critical severit

CVE-2022-26134 CRITICAL POC
9.8 Jun 03

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

CVE-2019-11580 CRITICAL POC
9.8 Jun 03

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Rated

CVE-2017-9506 MEDIUM POC
6.1 Aug 23

The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before

CVE-2024-21683 HIGH POC
8.8 May 21

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and

CVE-2022-36804 HIGH POC
8.8 Aug 25

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef

CVE-2017-5983 CRITICAL POC
9.8 Apr 10

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer,

Share

CVE-2026-41103 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy