What is the CVSS score of CVE-2026-63508?

CVE-2026-63508 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Planetary Computer Pro are affected by CVE-2026-63508?

Microsoft Planetary Computer Pro contains a critical privilege elevation vulnerability (CVSS 10.0) that enables unauthenticated remote attackers to gain elevated access and exfiltrate or modify…

How to fix or mitigate CVE-2026-63508?

Within 24 hours, inventory all Microsoft Planetary Computer Pro instances in production and restrict network access through firewall rules, network segmentation, or disable non-critical instances entirely. Within 7 days, deploy real-time logging and alerting for all API activity to detect exploitation attempts, conduct access log review for signs of compromise, and escalate findings to incident response. Within 30 days, establish a patching task with Microsoft-currently no patch is available-monitor security advisories daily for release, and develop a contingency plan including alternative geospatial platforms if patch delays extend beyond acceptable risk tolerance.

Planetary Computer Pro CVE-2026-63508

EUVD-2026-54325 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-07 secure@microsoft.com

GHSA-5969-wqc6-rfr4

Authentication Bypass Microsoft Planetary Computer

10.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

10.0 CRITICAL

Missing authentication makes the critical function network-reachable with no privileges or interaction (AV:N/AC:L/PR:N/UI:N); privilege elevation crosses an authorization boundary (S:C) yielding high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:35 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 10.0

DescriptionCVE.org

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Planetary Computer Pro allows a remote, unauthenticated attacker to gain elevated privileges over the network by invoking a critical function that lacks an authentication check (CWE-306). Scored CVSS 10.0 with a scope change, the flaw exposes confidential data and permits unauthorized modification against the affected Azure geospatial platform. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the maximal score reflects trivial exploitability against exposed instances.

Technical ContextAI

Microsoft Planetary Computer Pro is an Azure-hosted platform for cataloging, storing, and serving large-scale geospatial (STAC/raster) datasets to enterprise and scientific users. The root cause is CWE-306 (Missing Authentication for Critical Function): a security-sensitive operation - one that governs privilege or access control - is reachable without any credential or identity verification. Because the CVSS scope is Changed (S:C), the vulnerable component and the impacted component differ, indicating the exposed function lets an attacker cross a trust/authorization boundary managed by the service rather than merely acting within its own authority.

RemediationAI

No vendor-released patch version is identified in the available data; for a Microsoft-operated Azure service, the fix is typically applied by Microsoft to the service backend rather than by customers installing an update, so consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63508 to confirm whether any tenant-side action is required. As compensating controls pending confirmation, restrict network exposure of Planetary Computer Pro endpoints using Azure network security groups, private endpoints, or firewall rules so the vulnerable function is not reachable from untrusted networks (trade-off: may block legitimate external data consumers); enforce Azure AD/Entra authentication and conditional access in front of the service; and monitor access logs for anomalous privilege-related requests. Confirm exact remediation guidance and any exposure window with Microsoft before relying on these mitigations.