EUVD-2026-41446
GHSA-phr2-vr74-whpx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable service reached with an existing low-privileged account (PR:L), no user interaction, and an authorization bypass yielding full high impact to confidentiality, integrity, and availability.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Exchange Online allows an already-authenticated attacker to elevate their permissions over the network by exploiting an incorrect authorization check (CWE-863). Because Exchange Online is a cloud-hosted, multi-tenant service, a low-privileged authenticated user could gain elevated access to confidential data, tamper with mail/configuration, and disrupt availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold a valid authenticated account with at least low-level privileges in the target Exchange Online / Microsoft 365 environment (PR:L in the CVSS vector) - it is NOT remote-unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable, low attack complexity, no user interaction, and full high impact to confidentiality, integrity, and availability, but crucially requiring existing low-level privileges (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a low-privileged authenticated account in a tenant - for example through phishing or credential stuffing - sends crafted requests to Exchange Online that exploit the flawed authorization check to perform actions reserved for higher-privileged roles, such as reading other users' mailboxes or altering mail-flow configuration. With low attack complexity and no user interaction required, the action succeeds over the network once the attacker is authenticated. … |
| Remediation | Patch available per vendor advisory (RL:O confirms an official fix); as a cloud service, Microsoft applies the fix server-side to Exchange Online tenants, so no customer-installed update is generally required - verify remediation status and any required tenant actions via the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54998. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Contact your Microsoft account team to confirm patch availability and deployment timeline for your Exchange Online tenant. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today