CVE-2026-48579
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
Risk Assessment
An attacker can access sensitive data stored in Exchange Online, potentially leading to privacy breaches and data leakage.
Recommendation
Check if Microsoft has released an update or fix for Exchange Online. Implement additional authentication mechanisms such as MFA and monitor for unusual activity.
Other vulnerabilities in Microsoft Exchange Online
See all- CVE-2026-65801Critical
Server-side request forgery (SSRF) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-56191Critical
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-48582Critical
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
- CVE-2026-54998High
A vulnerability in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network due to incorrect authorization.
Original NVD description (English source)
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS