Microsoft Exchange Online CVE-2026-48579

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions and no user interaction are required - a remote attacker can attempt exploitation over the network against Microsoft Exchange Online without authentication or elevated privileges. The description specifies the impact is limited to information disclosure via improper authorization, so the attacker gains read access to confidential data only (C:H, I:N, A:N) and cannot modify or disrupt the service through this flaw. The primary limiting factor is that Exchange Online is a Microsoft-managed SaaS platform: once Microsoft deploys the service-side fix, the vulnerable code path is closed for all tenants simultaneously, and no exposed-then-patchable customer asset exists. No non-default configuration or specific platform version is documented as a prerequisite in the available data.

The signals are mixed and point to a real-but-not-urgent priority. The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with total confidentiality loss, and SSVC corroborates this with Automatable:yes and Technical Impact:total - a combination that on paper favors rapid action. However, SSVC Exploitation is 'none', there is no CISA KEV listing, no public exploit has been identified, and EPSS is very low at 0.07% (21st percentile), indicating little evidence of real-world exploitation activity. A key mitigating reality is that Exchange Online is a Microsoft-managed cloud service: the vendor deploys the fix centrally, so the window in which any given tenant is exposed is not controlled by customer patch cycles. The SSVC 'Automatable:yes / Technical Impact:total' rating deserves attention because it means that if an exploit were developed it could likely be scaled, so the low EPSS reflects current absence of exploitation rather than an inherently hard-to-exploit bug.

A remote attacker sends crafted requests to an Exchange Online endpoint that fails to properly enforce authorization, causing the service to return confidential mailbox or directory information the attacker is not entitled to view - all without needing valid credentials for the targeted data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N and SSVC rates the attack Automatable, such requests could in principle be scripted at scale; however, no public proof-of-concept or active exploitation has been identified at time of analysis.