What is the CVSS score of CVE-2026-57980?

CVE-2026-57980 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-57980?

Yes, a patch is available for CVE-2026-57980. Update the affected software to the latest version immediately.

Microsoft Edge CVE-2026-57980

EUVD-2026-45344 MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-17 microsoft

GHSA-fqqw-xx8r-56hq

Microsoft Google Authentication Bypass Microsoft Edge Chromium Based

5.4

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible browser flaw requiring user interaction; no attacker privileges needed; limited, bounded confidentiality and integrity impact with no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 22:01 vuln.today

CVE Published

Jul 17, 2026 - 21:29 cve.org

MEDIUM 5.4

DescriptionCVE.org

Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.

AnalysisAI

Authentication bypass in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to perform network-based tampering through an alternate path or channel that circumvents access controls (CWE-288). Affected users must interact with attacker-controlled content for exploitation to succeed (UI:R per CVSS), limiting opportunistic automation but keeping phishing-based delivery viable. No public exploit identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.

Technical ContextAI

Microsoft Edge (Chromium-based) is the affected product, identified by CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*:*:*:*:*:*:*:*, covering all tracked versions. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) describes a structural flaw where software enforces authentication on primary code paths but leaves secondary or alternate paths unguarded. In a Chromium-based browser context, this may manifest in browser-internal APIs, extension subsystems, or browser-mediated authentication flows where a secondary pathway fails to re-validate the caller's identity. The Google and Microsoft Edge Chromium tags in the intelligence data suggest the issue may touch shared Chromium plumbing, though the advisory is issued solely by Microsoft.

RemediationAI

Apply the vendor-released patch for Microsoft Edge (Chromium-based) available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57980. The exact patched Edge version is not independently confirmed from available data and should be verified against the MSRC advisory. Microsoft Edge supports automatic background updates by default; ensuring auto-update is enabled and not suppressed by group policy is the primary remediation action for most environments. As an interim compensating control where patching is delayed, security teams can reduce exposure by enforcing browser policies that restrict navigation to untrusted external URLs and by deploying phishing-resistant email filtering, which disrupts the UI:R delivery vector. There are no significant side effects to enabling auto-updates in standard enterprise deployments.