What is the CVSS score of CVE-2026-58596?

CVE-2026-58596 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft Edge are affected by CVE-2026-58596?

A vulnerability in Microsoft Edge could allow attackers to gain elevated access to employee computers through crafted websites, risking unauthorized access to corporate data and systems.. A patch is available.

How to fix or mitigate CVE-2026-58596?

Within 24 hours: Alert IT operations and business stakeholders; activate patch deployment procedures for Microsoft Edge. Within 7 days: Deploy the latest Microsoft Edge security patch to all organizational endpoints using your standard patch management system; consult the vendor advisory for the specific patched build version. Within 30 days: Audit endpoint inventory to confirm patch deployment across all systems and document completion.

Microsoft Edge CVE-2026-58596

EUVD-2026-43239 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-07-12 microsoft

GHSA-5xq8-3g6j-ph3q

Authentication Bypass Microsoft Google Microsoft Edge Chromium Based

8.3

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered web content (AV:N) needing victim interaction (UI:R) and a hard-to-build memory exploit (AC:H); no auth (PR:N); sandbox escape yields scope change (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 15:46 vuln.today

CVE Published

Jul 12, 2026 - 15:22 cve.org

HIGH 8.3

DescriptionCVE.org

Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Edge (Chromium-based) lets a network attacker escalate privileges by luring a victim into loading crafted web content that triggers an untrusted pointer dereference (CWE-822). Microsoft rates it CVSS 8.3, driven by a scope change (sandbox/boundary crossing) and full confidentiality, integrity, and availability impact, but exploitation requires user interaction and is of high attack complexity. No public exploit identified at time of analysis (E:U), it is not on CISA KEV, and an official vendor fix is available.

Technical ContextAI

The affected component is Microsoft's Edge browser built on the Chromium engine (CPE cpe:2.3:a:microsoft:microsoft_edge_(chromium-based):*). The root cause is CWE-822, Untrusted Pointer Dereference, in which code obtains a pointer value from an untrusted source (attacker-controlled web content or IPC data) and dereferences it without validation, letting an attacker steer memory access to a location of their choosing. In a Chromium-based browser this bug class typically lives in a renderer or in a more-privileged process reached across the sandbox boundary, which aligns with the reported scope change (S:C) and the 'elevate privileges over a network' framing - that is, breaking out of the low-privilege renderer into a higher-privilege context rather than a classic in-renderer RCE alone.

RemediationAI

Patch available per vendor advisory: update Microsoft Edge to the fixed Stable-channel build referenced in the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58596 (the exact fixed version is not specified in the provided data - do not assume a build number). Edge auto-updates by default, so verify update delivery via edge://settings/help and restart the browser to apply; in managed environments confirm the update ring / WSUS / Intune policy is not deferring the Stable channel. As an interim compensating control until patched, use group policy to restrict browsing to trusted sites and caution users against opening untrusted links or content (the bug requires user interaction), since there is no server-side toggle to disable the vulnerable code path; note this reduces but does not eliminate exposure and may disrupt legitimate browsing.