Microsoft Exchange Online
Monthly
Elevation of privilege in Microsoft Exchange Online lets an unauthorized network attacker abuse a server-side request forgery (CWE-918) flaw to make the service issue attacker-controlled internal requests, crossing a privilege/trust boundary (CVSS scope change) to reach backend resources. The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; Microsoft, the reporter, has already remediated the cloud service per its MSRC advisory.
Improper authentication in Microsoft Exchange Online lets a remote, unauthenticated attacker bypass authentication controls and tamper with data across a security boundary, with a maximum CVSS 3.1 base score of 10.0 driven by network reachability, no privileges required, and a scope change (S:C). Although the description emphasizes tampering (integrity), the CVSS vector rates confidentiality, integrity, and availability all High, indicating broad potential impact against Microsoft's multi-tenant cloud email service. No public exploit identified at time of analysis (E:U), and Microsoft has already deployed an official fix (RL:O) service-side.
Privilege escalation in Microsoft Exchange Online allows an already-authenticated attacker to elevate their permissions over the network by exploiting an incorrect authorization check (CWE-863). Because Exchange Online is a cloud-hosted, multi-tenant service, a low-privileged authenticated user could gain elevated access to confidential data, tamper with mail/configuration, and disrupt availability. No public exploit has been identified at time of analysis, and the EPSS/exploit-maturity signal (E:U) indicates exploit code is currently unproven.
Information disclosure in Microsoft Exchange Online allows a remote, unauthenticated attacker to access data they should not be able to reach by abusing an improper authorization check (CWE-285) over the network. Microsoft has published a fix in its cloud service, and no public exploit has been identified at time of analysis; EPSS rates exploitation probability very low (0.07%). Because Exchange Online is a Microsoft-operated SaaS offering, remediation is handled server-side by Microsoft rather than by customer patching.
Elevation of privilege in Microsoft Exchange Online lets an unauthorized network attacker abuse a server-side request forgery (CWE-918) flaw to make the service issue attacker-controlled internal requests, crossing a privilege/trust boundary (CVSS scope change) to reach backend resources. The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; Microsoft, the reporter, has already remediated the cloud service per its MSRC advisory.
Improper authentication in Microsoft Exchange Online lets a remote, unauthenticated attacker bypass authentication controls and tamper with data across a security boundary, with a maximum CVSS 3.1 base score of 10.0 driven by network reachability, no privileges required, and a scope change (S:C). Although the description emphasizes tampering (integrity), the CVSS vector rates confidentiality, integrity, and availability all High, indicating broad potential impact against Microsoft's multi-tenant cloud email service. No public exploit identified at time of analysis (E:U), and Microsoft has already deployed an official fix (RL:O) service-side.
Privilege escalation in Microsoft Exchange Online allows an already-authenticated attacker to elevate their permissions over the network by exploiting an incorrect authorization check (CWE-863). Because Exchange Online is a cloud-hosted, multi-tenant service, a low-privileged authenticated user could gain elevated access to confidential data, tamper with mail/configuration, and disrupt availability. No public exploit has been identified at time of analysis, and the EPSS/exploit-maturity signal (E:U) indicates exploit code is currently unproven.
Information disclosure in Microsoft Exchange Online allows a remote, unauthenticated attacker to access data they should not be able to reach by abusing an improper authorization check (CWE-285) over the network. Microsoft has published a fix in its cloud service, and no public exploit has been identified at time of analysis; EPSS rates exploitation probability very low (0.07%). Because Exchange Online is a Microsoft-operated SaaS offering, remediation is handled server-side by Microsoft rather than by customer patching.