CVE-2026-48582
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An attacker with valid permissions may gain access to resources they should not have access to, potentially leading to serious security breaches.
Recommendation
It is recommended to review and strengthen authorization mechanisms in Microsoft Exchange Online to prevent unauthorized privilege escalation.
Other vulnerabilities in Microsoft Exchange Online
See all- CVE-2026-65801Critical
Server-side request forgery (SSRF) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-56191Critical
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-48579Critical
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
- CVE-2026-54998High
A vulnerability in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network due to incorrect authorization.
Original NVD description (English source)
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS