Microsoft Bookings CVE-2026-94510

Exploitation requires network access to the Microsoft Bookings service and the ability to supply a user-controlled reference key (an identifier such as a booking, mailbox, or object ID) that the application uses for authorization without proper ownership validation (CWE-639). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are required against the affected service, and attack complexity is low. The primary limiting factor is that Bookings is a Microsoft-hosted service that the vendor has already patched server-side; impact is bounded to the service's data/privilege model (CVSS impact C:L/I:H/A:L), and the E:U metric indicates no proven exploit code is circulating.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated authorization bypass (CWE-639, user-controlled key/IDOR) with a scope change (S:C) and impacts C:L/I:H/A:L, driving the 9.9 base score. However, the temporal metrics materially lower real-world urgency: E:U (Exploit Code Unproven) and RL:O (Official fix available) indicate no working exploit is known and a patch exists, while RC:C confirms the flaw itself. No CISA KEV listing and no POC are present in the provided data, so despite the 9.9 headline there is currently no evidence of active or imminent exploitation. EPSS is NOT provided, so probabilistic exploitation likelihood cannot be assessed - a key gap. SSVC inputs are not supplied, but inferring from CVSS: automatable exploitation is plausible (AV:N/PR:N/UI:N) and technical impact is at least partial-to-total given I:H and scope change. Net: this is a genuinely high-priority patch-now item for a widely-used Microsoft 365 service because of the unauthenticated network vector and privilege elevation, but the 'E:U' and absence of KEV/POC/EPSS suggest it is not yet weaponized and the score reflects potential rather than demonstrated exploitation.

A remote, unauthenticated attacker sends crafted requests to a Microsoft Bookings endpoint, substituting a reference key (such as an object or booking identifier) that belongs to another tenant or user to access or manipulate resources they should not control, elevating their effective privileges over the network. No public exploit code or POC is identified at time of analysis, and the official vendor fix is already available.