AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-54998

Microsoft Exchange Online: improper authorization

Microsoft

CVE-2026-54998 · Published Jul 2, 2026 · updated Jul 7, 2026

High8.8
No fix yet
Microsoft advisory

Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

Affected versions

PackageAffectedFixed in
Microsoft Exchange Online
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-863

More Microsoft advisories

All Microsoft
High 8.8Jul 3Microsoft Edge (Chromium-based): integer overflowCVE-2026-57974fixed in 150.0.4078.48Critical 9.9Jul 2Microsoft Azure Open AI: server-side request forgeryCVE-2026-45499no fix yetCritical 9.9Jul 2Microsoft Entra Provisioning Service: server-side request forgeryCVE-2026-57100no fix yetCritical 9.3Jul 2Microsoft 365 Copilot: open redirectCVE-2026-41106no fix yetMedium 4.8Jul 2Microsoft Azure Synapse: improper access controlCVE-2026-26145no fix yetHigh 8.3Jul 1Microsoft Edge (Chromium-based): use after freeCVE-2026-50521fixed in 149.0.4022.68