What is the CVSS score of EUVD-2026-38090?

EUVD-2026-38090 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Exchange Online are affected by EUVD-2026-38090?

Microsoft Exchange Online users face a critical authorization bypass vulnerability allowing authenticated users to escalate privileges and access resources across tenant boundaries.. A patch is available.

How to fix or mitigate EUVD-2026-38090?

Within 24 hours: Enable comprehensive audit logging for privilege escalation and cross-tenant resource access attempts; brief incident response team on exposure risks. Within 7 days: Enforce multi-factor authentication for all administrative accounts and restrict cross-tenant mailbox delegation via Exchange admin policies. Within 30 days: Prepare rapid deployment procedures for the Microsoft patch; test patch in staging environment and validate access controls post-deployment.

Microsoft Exchange Online EUVD-2026-38090

| CVE-2026-48582 CRITICAL

Missing Authorization (CWE-862)

2026-06-19 secure@microsoft.com

GHSA-j97v-rpjv-q4wf

Authentication Bypass Microsoft Exchange Online

9.6

CVSS 3.1 · Vendor: microsoft

Temporal: 8.3

Severity by source

Vendor (microsoft) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CIRCL (temporal)

8.3 HIGH

cvss

vuln.today AI

9.6 CRITICAL

Network-reachable SaaS endpoint (AV:N), no special conditions (AC:L), requires any authenticated tenant user (PR:L), no victim interaction (UI:N), missing authz crosses tenant/role boundary (S:C) with high C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 21:40 vuln.today

CVE Published

Jun 19, 2026 - 21:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Exchange Online allows an authenticated remote attacker to elevate privileges across a tenant or organizational boundary due to missing authorization checks. The flaw carries a CVSS 3.1 score of 9.6 with scope change, indicating impact beyond the initially authorized security context, though no public exploit identified at time of analysis. As a cloud-hosted service, mitigation is largely Microsoft-managed rather than a customer-applied patch.

Technical ContextAI

Microsoft Exchange Online is the cloud-hosted email and calendaring service delivered as part of Microsoft 365, built on top of the Exchange Server platform but operated as a multi-tenant SaaS. The root cause is CWE-862 (Missing Authorization), meaning code paths that perform a privileged action fail to verify that the calling principal is actually entitled to perform it. In a multi-tenant cloud mail platform, such gaps typically appear in REST endpoints, EWS/Graph operations, or administrative management surfaces where role and tenant boundary checks must be enforced server-side; a missing check lets a low-privileged identity invoke functionality reserved for higher-privileged roles.

RemediationAI

Patch available per vendor advisory: because Exchange Online is a Microsoft-managed cloud service, the fix is deployed by Microsoft to the service backend and does not require customer-side patching - administrators should review https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48582 to confirm the service-side mitigation has reached their tenant and whether any configuration action is required. As compensating controls while verifying remediation status, enforce Conditional Access policies that require MFA and compliant devices for all Exchange Online access (which limits the pool of attackers who can authenticate at PR:L), restrict legacy authentication protocols such as Basic Auth and EWS where business-tolerable (reducing attack surface but potentially breaking legacy clients), audit Unified Audit Log for anomalous role assignments and mailbox permission grants, and review privileged Exchange role group membership (Organization Management, Recipient Management) to shrink blast radius. None of these workarounds substitute for Microsoft's backend fix.