Microsoft Partner Center
Monthly
Improper certificate validation in Microsoft Partner Center allows a network-positioned attacker to impersonate the service and gain elevated privileges, with a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) though exploit maturity is unproven (E:U). Exploitation requires the attacker to intercept, relay, or inject into the TLS path and present a certificate the service wrongly accepts (CWE-295); no authentication or user interaction is needed, and no public exploit code has been identified. As a Microsoft-hosted cloud service, the fix is deployed centrally by Microsoft.
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Remote unauthenticated attackers can exploit a server-side request forgery (SSRF) vulnerability in Microsoft Partner Center to access internal resources and perform spoofing attacks. The vulnerability allows high-level information disclosure with limited integrity impact, requiring no user interaction or special privileges. Microsoft has released a security patch, and while CVSS rates this 8.2 (High), no active exploitation or public proof-of-concept has been identified at time of analysis.
Privilege escalation in Microsoft Partner Center allows an authenticated, low-privileged user to elevate their access over the network due to improper access control (CWE-284), crossing a security boundary (CVSS scope-changed, 9.6). With confidentiality and integrity impact rated High and a scope change, a successful attacker can reach data or functions belonging to other tenants or higher privilege levels within the Partner Center platform. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC lists exploitation status as none.
Improper certificate validation in Microsoft Partner Center allows a network-positioned attacker to impersonate the service and gain elevated privileges, with a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) though exploit maturity is unproven (E:U). Exploitation requires the attacker to intercept, relay, or inject into the TLS path and present a certificate the service wrongly accepts (CWE-295); no authentication or user interaction is needed, and no public exploit code has been identified. As a Microsoft-hosted cloud service, the fix is deployed centrally by Microsoft.
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Remote unauthenticated attackers can exploit a server-side request forgery (SSRF) vulnerability in Microsoft Partner Center to access internal resources and perform spoofing attacks. The vulnerability allows high-level information disclosure with limited integrity impact, requiring no user interaction or special privileges. Microsoft has released a security patch, and while CVSS rates this 8.2 (High), no active exploitation or public proof-of-concept has been identified at time of analysis.
Privilege escalation in Microsoft Partner Center allows an authenticated, low-privileged user to elevate their access over the network due to improper access control (CWE-284), crossing a security boundary (CVSS scope-changed, 9.6). With confidentiality and integrity impact rated High and a scope change, a successful attacker can reach data or functions belonging to other tenants or higher privilege levels within the Partner Center platform. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC lists exploitation status as none.