EUVD-2026-41446
GHSA-phr2-vr74-whpx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable service reached with an existing low-privileged account (PR:L), no user interaction, and an authorization bypass yielding full high impact to confidentiality, integrity, and availability.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Exchange Online allows an already-authenticated attacker to elevate their permissions over the network by exploiting an incorrect authorization check (CWE-863). Because Exchange Online is a cloud-hosted, multi-tenant service, a low-privileged authenticated user could gain elevated access to confidential data, tamper with mail/configuration, and disrupt availability. No public exploit has been identified at time of analysis, and the EPSS/exploit-maturity signal (E:U) indicates exploit code is currently unproven.
Technical ContextAI
The vulnerability lies in the authorization logic of Microsoft Exchange Online (CPE cpe:2.3:a:microsoft:microsoft_exchange_online), Microsoft's cloud-based email and collaboration service that is part of Microsoft 365. The root cause is CWE-863 (Incorrect Authorization): the service performs an authorization decision but does so incorrectly, allowing an action or resource access that should be denied for the requesting principal's privilege level. Rather than a missing check, the flaw is a flawed check - permissions are evaluated but the wrong outcome is reached, enabling a valid but under-privileged account to perform operations reserved for higher-privileged roles.
RemediationAI
Patch available per vendor advisory (RL:O confirms an official fix); as a cloud service, Microsoft applies the fix server-side to Exchange Online tenants, so no customer-installed update is generally required - verify remediation status and any required tenant actions via the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54998. As compensating controls while confirming remediation, enforce least-privilege on Exchange/Microsoft 365 role assignments and remove unnecessary elevated or delegated permissions (trade-off: may disrupt admin workflows that rely on broad delegation), require MFA and conditional-access policies to reduce the risk of the low-privileged account prerequisite being met via credential theft, and audit Exchange admin and mailbox permission changes for anomalous privilege grants. Because exploitation requires an authenticated account, promptly disabling or resetting suspicious or dormant accounts materially reduces exposure.
More in Microsoft Exchange Online
View allImproper authentication in Microsoft Exchange Online lets a remote, unauthenticated attacker bypass authentication contr
Elevation of privilege in Microsoft Exchange Online lets an unauthorized network attacker abuse a server-side request fo
Information disclosure in Microsoft Exchange Online allows a remote, unauthenticated attacker to access data they should
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today