EUVD-2026-34338
GHSA-jwv5-9w8q-m2j8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable improper-authorization flaw exploitable without auth or interaction (AV:N/AC:L/PR:N/UI:N), yielding confidentiality-only disclosure (C:H, I:N, A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft Exchange Online allows a remote, unauthenticated attacker to access data they should not be able to reach by abusing an improper authorization check (CWE-285) over the network. Microsoft has published a fix in its cloud service, and no public exploit has been identified at time of analysis; EPSS rates exploitation probability very low (0.07%). Because Exchange Online is a Microsoft-operated SaaS offering, remediation is handled server-side by Microsoft rather than by customer patching.
Technical ContextAI
Microsoft Exchange Online is the cloud-hosted email, calendaring, and collaboration component of Microsoft 365, delivered as a multi-tenant SaaS platform accessed over standard web and mail protocols (HTTPS, EWS, Graph, Outlook clients). The root cause is classified as CWE-285 (Improper Authorization), meaning the service performed an action or returned data without correctly verifying that the requesting principal was permitted to access it. The CPE (cpe:2.3:a:microsoft:microsoft_exchange_online) confirms the affected asset is the online service itself rather than on-premises Exchange Server. With a CVSS impact profile of C:H/I:N/A:N, the flaw exposes confidential information only - an authorization boundary is crossed to read data, but nothing is modified or made unavailable. The 'Authentication Bypass' tag combined with PR:N in the vector suggests the authorization control could be circumvented without the attacker holding valid credentials for the targeted data.
RemediationAI
Patch available per vendor advisory - because Exchange Online is a Microsoft-operated cloud service, the fix is deployed centrally by Microsoft and requires no customer-side installation; administrators should confirm remediation status and any required tenant actions via the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48579. No exact customer-installable fix version applies to a SaaS product. As defense-in-depth while relying on Microsoft's service-side fix, organizations can tighten access to sensitive mailboxes and data by enforcing Conditional Access policies (restricting by device compliance, location, or managed-network), reviewing and minimizing broad application/API permissions and delegated mailbox access that could widen the blast radius of an authorization flaw, and enabling detailed mailbox and Purview audit logging to detect anomalous cross-tenant or cross-mailbox data access; note that stricter Conditional Access can disrupt legitimate remote or unmanaged-device access and should be validated against business workflows before broad enforcement.
More in Microsoft Exchange Online
View allImproper authentication in Microsoft Exchange Online lets a remote, unauthenticated attacker bypass authentication contr
Elevation of privilege in Microsoft Exchange Online lets an unauthorized network attacker abuse a server-side request fo
Privilege escalation in Microsoft Exchange Online allows an already-authenticated attacker to elevate their permissions
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today