Microsoft Partner Center
Monthly
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Privilege escalation in Microsoft Partner Center allows an authenticated, low-privileged user to elevate their access over the network due to improper access control (CWE-284), crossing a security boundary (CVSS scope-changed, 9.6). With confidentiality and integrity impact rated High and a scope change, a successful attacker can reach data or functions belonging to other tenants or higher privilege levels within the Partner Center platform. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC lists exploitation status as none.
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Privilege escalation in Microsoft Partner Center allows an authenticated, low-privileged user to elevate their access over the network due to improper access control (CWE-284), crossing a security boundary (CVSS scope-changed, 9.6). With confidentiality and integrity impact rated High and a scope change, a successful attacker can reach data or functions belonging to other tenants or higher privilege levels within the Partner Center platform. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC lists exploitation status as none.