EUVD-2026-54326
GHSA-c89r-fxpx-x3w6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach M365 Admin Center over network
-
DeliveryForge token with tampered claims
-
ExploitBypass signature verification (CWE-347)
-
ExecutionService accepts forged identity
-
PersistElevate to administrative privileges
-
ImpactControl tenant resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability to the Microsoft 365 Admin Center service - no authentication, no privileges, and no user interaction. The concrete prerequisite implied by CWE-347 and the 'JWT Attack' tag is the ability to submit a crafted token/message whose signature the service fails to validate correctly; the attacker must be able to reach the portal's token-accepting endpoint over the network. Limiting factors are minimal given the vector: exploitation is bounded mainly by whatever network/Conditional-Access restrictions a tenant places in front of the admin portal and by Microsoft's server-side remediation, since this is a hosted service rather than a customer-deployed build. Authentication requirement is confirmed unauthenticated from PR:N in the provided vector. |
| Impact | The signals are largely aligned toward high priority but incomplete on real-world exploitation. CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N - network reachable, low complexity, no privileges, no user interaction, with High confidentiality, integrity, and availability impact - the most severe possible base profile for a scope-unchanged flaw. The CWE-347 root cause and 'JWT Attack'/'Authentication Bypass' tags corroborate a reliable, deterministic exploit primitive rather than a memory-corruption race, which typically means high automatability if a working technique is developed. However, EPSS is not provided, there is no POC referenced, and KEV status is negative, so exploitation probability cannot be quantified from the input. No SSVC decision data was supplied. Net: treat as a critical severity issue on paper; because the affected component is a Microsoft-hosted cloud service, remediation is largely Microsoft's responsibility server-side, which lowers customer-side action burden but does not lower the intrinsic severity. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker crafts a token with forged or manipulated claims (e.g., an admin role) and submits it to the Microsoft 365 Admin Center, which fails to properly verify its cryptographic signature and honors the forged identity/authorization. Given AV:N/AC:L/PR:N/UI:N, the attacker needs only network access to the portal and no valid credentials or victim interaction, yielding elevated tenant privileges. No public POC is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 07, 2026
Privilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions by exploiting improper verification of a cryptographic signature (CWE-347), consistent with the vendor-supplied 'Authentication Bypass' and 'JWT Attack' tags. The maximal 9.8 CVSS with a fully network-reachable, no-privilege, no-interaction vector makes this a critical bypass of the admin portal's trust boundary. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
RemediationAI
Because Microsoft 365 Admin Center is a Microsoft-operated cloud service, the fix is deployed server-side by Microsoft and generally requires no customer installation - Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62873; confirm remediation status and any tenant-side action directly in that advisory. No exact fix version applies to a SaaS component. As compensating and detective controls, review Microsoft 365 admin audit logs and Entra ID sign-in/role-assignment logs for unexpected privilege escalations or anomalous administrative actions, enforce Conditional Access and phishing-resistant MFA on all admin roles, apply least-privilege and Privileged Identity Management (PIM) just-in-time role activation to shrink the blast radius of any forged-token access, and restrict admin portal access to managed devices or trusted network locations where feasible - noting that network/device restrictions can impede legitimate remote administration and should be validated against operational needs.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Microsoft 365 Admin Center is Microsoft's cloud-hosted administrative portal for managing M365 tenants (users, licenses, roles, security settings). CWE-347 (Improper Verification of Cryptographic Signature) is the root-cause class: the service accepts a token or message without correctly validating its signature. The 'JWT Attack' tag strongly implies the flaw lies in JSON Web Token validation - for example accepting an unsigned/alg:none token, failing to verify the signing key, or confusing symmetric and asymmetric key handling - which would let an attacker forge or tamper with an identity/authorization token. Because signature verification is the mechanism that binds a token's claims to a trusted issuer, its failure directly translates into an authentication/authorization bypass. No CPE strings were supplied since this is a Microsoft-operated SaaS service rather than customer-installed software.
Know when Jwt Attack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable signature-verification/JWT bypass needs no privileges or interaction (PR:N/UI:N/AC:L), and forged admin access yields high C/I/A over the tenant.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
A critical authentication bypass in Microsoft 365 Admin Center enables unauthenticated attackers to remotely escalate to administrator privileges, potentially compromising entire Microsoft 365 tenants and sensitive organizational data. This vulnerability poses an immediate risk to any organization operating Microsoft 365 and requires urgent containment before a vendor patch becomes available. Without rapid mitigation, attackers could gain persistent admin access to email, collaboration platforms, and corporate data.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict Admin Center access to hardened, isolated administrative hosts with separate credentials; (2) Implement IP-based and geofence-based access controls; (3) Enable continuous monitoring and anomaly detection on administrative accounts; (4) Enforce advanced threat protection and real-time alerts for Admin Center activity; (5) Maintain detailed audit logs with extended retention for forensic investigation; (6) Disable non-critical administrative functions until patch availability; (7) Consider enhanced identity verification for any Admin Center access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated a
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
Exploit-DB