CVE Intelligence
Analysis AI-assisted

CVE-2026-48582: Microsoft Exchange Online - Missing Authorization Leading to Privilege Escalation

Microsoft has published CVE-2026-48582, a missing authorization flaw (CWE-862) in Microsoft Exchange Online that lets an authorized attacker elevate privileges over the network. The CNA rates it critical with a CVSS 3.1 base score of 9.6. The sources consulted list no confirmed exploitation and no affected or fixed version numbers.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-48582 is a missing authorization issue (CWE-862) in Microsoft Exchange Online, published on 2026-06-19 with Microsoft acting as the CNA. The description states that an authorized attacker over the network can elevate privileges. Missing authorization means the service does not adequately verify whether an authenticated user is allowed to perform a given action.

Impact

  • According to the CVSS vector supplied by the CNA, the attack vector is network, attack complexity is low, low privileges are required, no user interaction is needed, and the scope is changed.
  • Confidentiality and integrity impacts are rated high, while availability impact is rated none.
  • The CNA base score is 9.6, which corresponds to a critical severity.

Affected products and versions

  • Product: Microsoft Exchange Online.
  • The record states that versions are not specified by the source. No affected version range is available in the sources consulted.

Exploitation status

This CVE is not listed in the CISA KEV catalog within the record, so no active exploitation is confirmed in the sources consulted. This does not rule out future exploitation.

Remediation and mitigation

  • The record lists no fixed version. The absence of a listed fix does not mean no fix exists, so consult the Microsoft Security Update Guide for vendor guidance.
  • Exchange Online is a cloud service, so the vendor typically applies service-side changes. This is an inference and should be verified in the vendor advisory.
  • In the meantime, review role assignments and administrative permissions in your tenant and apply the principle of least privilege, since the flaw involves privilege elevation by authenticated users.

Detection guidance

  • Review audit logs for unexpected changes to roles, permissions, mailbox delegation or administrative settings.
  • Look for accounts that recently gained privileges that do not match business needs.
  • Keep sign-in and administrative activity monitoring enabled and reviewed.

Limitations of the available information

  • The record does not specify affected versions, fixed versions, technical details or exploitation evidence.
  • The CVSS data come from the CNA, and no other provider score is listed.
  • EPSS and SSVC data are not available in the record.

Frequently asked questions

Is CVE-2026-48582 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Monitor official advisories for updates.

Which versions of Exchange Online are affected?

The record states that versions are not specified by the source, so the affected version range is unknown. Check the Microsoft Security Update Guide for the latest information.

What should administrators do now?

Review administrative roles and permissions, apply least privilege, monitor audit logs for unexpected privilege changes, and follow the vendor guidance for this CVE.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.