EUVD-2026-48458
GHSA-w7qh-jvr9-qmx9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable, unauthenticated auth bypass (AV:N/AC:L/PR:N/UI:N) crossing the tenant boundary (S:C); description asserts tampering so I:H, with only limited confidentiality (C:L) and no clear availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
AnalysisAI
Improper authentication in Microsoft Exchange Online lets a remote, unauthenticated attacker bypass authentication controls and tamper with data across a security boundary, with a maximum CVSS 3.1 base score of 10.0 driven by network reachability, no privileges required, and a scope change (S:C). Although the description emphasizes tampering (integrity), the CVSS vector rates confidentiality, integrity, and availability all High, indicating broad potential impact against Microsoft's multi-tenant cloud email service. No public exploit identified at time of analysis (E:U), and Microsoft has already deployed an official fix (RL:O) service-side.
Technical ContextAI
Exchange Online is Microsoft's cloud-hosted email and collaboration service delivered as part of Microsoft 365, so the vulnerable component runs in Microsoft's own infrastructure rather than in customer-managed servers. The root cause is classified as CWE-287 (Improper Authentication), meaning the service failed to correctly verify an entity's claimed identity, allowing an actor to act with privileges or access it should not have. The scope-changed metric (S:C) in the CVSS vector signals that the flaw in the vulnerable authentication component can affect resources beyond its own security authority - consistent with a multi-tenant cloud identity boundary being crossed. The single CPE, cpe:2.3:a:microsoft:microsoft_exchange_online:*:*:*:*:*:*:*:*, is version-agnostic because the service is continuously updated by the vendor and has no discrete customer-installed build.
RemediationAI
Patch available per vendor advisory: because Exchange Online is a Microsoft-operated cloud service, the fix (RL:O, Official) is deployed by Microsoft server-side and generally requires no customer action to install - review https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56191 to confirm whether any tenant-side configuration change or follow-up is recommended. As compensating hygiene while confirming the advisory details, enforce phishing-resistant multi-factor authentication and Conditional Access policies, review Exchange Online audit and sign-in logs for anomalous authentication or unexpected mailbox/data changes, and tighten OAuth application and delegated-permission consent to limit any authentication-boundary abuse; note that aggressive Conditional Access restrictions can disrupt legitimate client access and mail flow, so stage them carefully. Do not rely on customer-side patching for the core flaw, as the remediation is under Microsoft's control.
More in Microsoft Exchange Online
View allElevation of privilege in Microsoft Exchange Online lets an unauthorized network attacker abuse a server-side request fo
Privilege escalation in Microsoft Exchange Online allows an already-authenticated attacker to elevate their permissions
Information disclosure in Microsoft Exchange Online allows a remote, unauthenticated attacker to access data they should
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today