What is the CVSS score of EUVD-2026-54326?

EUVD-2026-54326 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft 365 Admin Center are affected by EUVD-2026-54326?

A critical authentication bypass in Microsoft 365 Admin Center enables unauthenticated attackers to remotely escalate to administrator privileges, potentially compromising entire Microsoft 365…

How to fix or mitigate EUVD-2026-54326?

Within 24 hours: Conduct an immediate audit of Microsoft 365 Admin Center access logs to identify anomalous sign-ins or unauthorized privilege grants; restrict Admin Center access to a hardened, network-isolated administrative workstation and enable enhanced logging of all admin activities. Within 7 days: Implement network-layer segmentation limiting Admin Center access to specific corporate IP ranges or geofenced locations; coordinate with Microsoft Support for interim guidance and monitoring recommendations. Within 30 days: Monitor Microsoft Security Update Guide daily for CVE-2026-62873 patch release; prepare and test a rapid deployment plan for vendor patches once available; evaluate temporary administrative workarounds or alternative Microsoft 365 management tools during the interim period.

Microsoft 365 Admin Center EUVD-2026-54326

| CVE-2026-62873 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-07 secure@microsoft.com

GHSA-c89r-fxpx-x3w6

Authentication Bypass Microsoft Jwt Attack Windows Admin Center

9.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.8 CRITICAL

Network-reachable signature-verification/JWT bypass needs no privileges or interaction (PR:N/UI:N/AC:L), and forged admin access yields high C/I/A over the tenant.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:33 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions by exploiting improper verification of a cryptographic signature (CWE-347), consistent with the vendor-supplied 'Authentication Bypass' and 'JWT Attack' tags. The maximal 9.8 CVSS with a fully network-reachable, no-privilege, no-interaction vector makes this a critical bypass of the admin portal's trust boundary. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Technical ContextAI

The Microsoft 365 Admin Center is Microsoft's cloud-hosted administrative portal for managing M365 tenants (users, licenses, roles, security settings). CWE-347 (Improper Verification of Cryptographic Signature) is the root-cause class: the service accepts a token or message without correctly validating its signature. The 'JWT Attack' tag strongly implies the flaw lies in JSON Web Token validation - for example accepting an unsigned/alg:none token, failing to verify the signing key, or confusing symmetric and asymmetric key handling - which would let an attacker forge or tamper with an identity/authorization token. Because signature verification is the mechanism that binds a token's claims to a trusted issuer, its failure directly translates into an authentication/authorization bypass. No CPE strings were supplied since this is a Microsoft-operated SaaS service rather than customer-installed software.

RemediationAI

Because Microsoft 365 Admin Center is a Microsoft-operated cloud service, the fix is deployed server-side by Microsoft and generally requires no customer installation - Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62873; confirm remediation status and any tenant-side action directly in that advisory. No exact fix version applies to a SaaS component. As compensating and detective controls, review Microsoft 365 admin audit logs and Entra ID sign-in/role-assignment logs for unexpected privilege escalations or anomalous administrative actions, enforce Conditional Access and phishing-resistant MFA on all admin roles, apply least-privilege and Privileged Identity Management (PIM) just-in-time role activation to shrink the blast radius of any forged-token access, and restrict admin portal access to managed devices or trusted network locations where feasible - noting that network/device restrictions can impede legitimate remote administration and should be validated against operational needs.