CVE-2026-54998
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
A vulnerability in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network due to incorrect authorization.
Risk Assessment
An attacker could gain higher privileges, potentially leading to unauthorized access to sensitive data or takeover of the email system.
Recommendation
Apply security updates provided by Microsoft for Exchange Online and monitor logs for suspicious privilege escalation activities.
Other vulnerabilities in Microsoft Exchange Online
See all- CVE-2026-65801Critical
Server-side request forgery (SSRF) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-56191Critical
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-48582Critical
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
- CVE-2026-48579Critical
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
- CVE-2026-96185High
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS