CVE-2026-41103: Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege
Microsoft published CVE-2026-41103 for its SSO plugin for Jira and Confluence, caused by an incorrect implementation of an authentication algorithm. The record rates it critical with a CVSS base score of 9.1 and states that an unauthorized attacker on the network can elevate privileges. No confirmed exploitation appears in the sources consulted, and the record lists no fixed versions.
Overview
Microsoft published CVE-2026-41103 for its SSO plugin used with Jira and Confluence. The record attributes the issue to an incorrect implementation of an authentication algorithm, classified as CWE-303, and assigns a critical CVSS base score of 9.1.
Impact
- The CVSS vector rates confidentiality and integrity impact as high and availability impact as none.
- The vector requires no privileges and no user interaction, and the attack vector is network.
- The record states that an unauthorized attacker can elevate privileges. The extent of data or administrative functions exposed is not described in the record.
Affected products and versions
- Microsoft Confluence SAML SSO plugin: the record lists versions before 7.4.0, and in a second entry a range from 1.0.0 before 7.4.0.
- Microsoft Jira SAML SSO plugin: the record lists versions before 1.3.3, and in a second entry a range from 1.0.0 before 1.3.3.
- The record contains no fixed-version list. Versions at or above the listed endpoints are outside the stated ranges, which is an inference rather than a confirmed fix statement.
Exploitation status
No confirmed exploitation appears in the sources consulted. The record shows the vulnerability is not listed in the CISA KEV catalog. The SSVC fields record exploitation as none and automatable as yes, and EPSS shows a probability of 0.00798 with a percentile of 0.56082 as of the recorded date. The automatable attribute is a scoring property, not evidence of attacks.
Remediation and mitigation
- Review the Microsoft update guide entry and apply the vendor update for the affected SSO plugin on both Jira and Confluence.
- Inventory installed SSO plugin versions and compare them against the vendor guidance, since the record does not provide fixed versions.
- Until updated, limit network exposure of administrative interfaces and review the SSO configuration as recommended by the vendor.
- The absence of a listed fixed version does not mean no fix exists.
Detection guidance
- Review authentication and audit logs for unexpected role or permission changes in Jira and Confluence.
- Watch for newly created administrative accounts or unexpected group membership changes.
- Correlate SSO sign-in events with identity provider records to spot logins that do not match expected activity.
Limitations of the available information
- The record does not include a fixed version, technical root-cause details, or independent analysis.
- The vendor advisory content was not included in the record, so the exact affected builds should be confirmed there.
- The CWE name is missing from the record.
Frequently asked questions
What is CVE-2026-41103?
It is a vulnerability in the Microsoft SSO Plugin for Jira and Confluence caused by an incorrect implementation of an authentication algorithm, which the record says allows an unauthorized network attacker to elevate privileges.
Is this vulnerability being actively exploited?
No confirmed exploitation appears in the sources consulted, and the record shows it is not listed in the CISA KEV catalog.
Which versions are affected?
The record lists the Confluence plugin before 7.4.0 and the Jira plugin before 1.3.3, with ranges starting at 1.0.0. The record does not provide a fixed-version list, so the vendor advisory should be checked.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.