CVE Intelligence
Analysis AI-assisted

CVE-2026-26125: Microsoft Payment Orchestrator Service - Elevation of Privilege (CWE-306)

CVE-2026-26125 is an elevation of privilege vulnerability in Microsoft Payment Orchestrator Service, classified as missing authentication for a critical function. NVD rates it critical with a base score of 9.8, while Microsoft-provided scores in the record are 8.6. The record shows no confirmed exploitation and no fixed versions.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Microsoft published CVE-2026-26125, an elevation of privilege issue in the Payment Orchestrator Service. The record classifies the weakness as CWE-306 (missing authentication for a critical function). The CVE was published on 2026-03-05 and Microsoft is the CNA.

Impact

The NVD base score is 9.8 (critical). The NVD vector describes a network-reachable attack that requires no privileges and no user interaction, with high impact on confidentiality, integrity and availability. Microsoft-provided scores in the record are 8.6. The record does not explain the difference between the scores.

Affected products and versions

  • Product listed: Microsoft Payment Orchestrator Service.
  • Affected version ranges: not specified by the sources consulted.
  • The record contains no fixed versions.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The record gives an EPSS probability of 0.01151 (percentile 0.66695) and an SSVC exploitation value of none.

Remediation and mitigation

  • Review the Microsoft Security Response Center advisory for vendor guidance: MSRC advisory.
  • Inventory all deployments of the Payment Orchestrator Service and check them against the advisory.
  • Because the weakness involves missing authentication, limit network reachability of the service to trusted components until vendor guidance is confirmed.
  • Prioritize review because the base score is critical and payment workflows are high-value targets.

Detection guidance

  • Review service logs for requests to privileged or administrative functions that lack authentication context.
  • Monitor for unexpected changes to payment orchestration configuration or role assignments.

Limitations of the available information

  • Affected version ranges, fixed builds and technical details are not in the record.
  • The advisory content itself was not reviewed; only its URL is recorded.
  • The title refers to elevation of privilege while the CWE refers to missing authentication; the relationship between them is an inference.

Frequently asked questions

What is CVE-2026-26125?

It is an elevation of privilege vulnerability in Microsoft Payment Orchestrator Service, classified as CWE-306, missing authentication for a critical function.

Is this CVE known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The sources consulted do not specify affected version ranges, and the record contains no fixed versions.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.