Microsoft Partner Center EUVD-2026-63628

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network access is sufficient with no authentication barrier per the official scoring, and the underlying condition is the application's use of user-supplied keys or resource identifiers as the sole access control mechanism without server-side authorization validation (CWE-639). Exploitation is limited to confidentiality impact only - I:N and A:N confirm that data cannot be modified and service availability is not affected. A meaningful uncertainty exists: Partner Center is a portal that ordinarily requires a Microsoft partner account, and the PR:N rating conflicts with that access model; the exact authentication threshold (none vs. low-privilege account) must be confirmed from the MSRC advisory before concluding that zero-credential exploitation is achievable. Exploitation scope is bounded to data accessible through the Partner Center API surface.

The CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) rates this as High severity with a fully network-accessible attack surface, low complexity, and no stated prerequisites, making the vulnerability attractive for automated enumeration at scale. The Scope:Changed and C:H combination indicates cross-tenant data disclosure - potentially customer records, subscription details, billing information, or organizational profiles - as the primary risk. No EPSS score was supplied and the CVE is not listed in the CISA KEV catalog at time of analysis, meaning widespread or opportunistic exploitation has not been confirmed; however, the sensitivity of partner ecosystem data and the zero-friction CVSS profile warrant urgent patch prioritization regardless of observed exploitation activity. A notable tension exists between the PR:N rating and the reality that Partner Center is a portal normally requiring a Microsoft partner account: whether exploitation is truly pre-authentication or requires a minimal account should be verified against the vendor advisory before concluding zero-credential exploitation is confirmed.

An attacker with network access submits API requests to Microsoft Partner Center, substituting or incrementing resource or tenant identifiers within the request parameters to bypass authorization checks and retrieve confidential data belonging to other partner tenants - such as customer subscription details, billing records, or organizational profiles. The low attack complexity and absence of required privileges per the CVSS vector mean that exploitation can be scripted and executed at volume against the Partner Center API surface. No public proof-of-concept code has been identified at time of analysis.