CVE-2026-54998

Microsoft · Published July 2, 2026

8.8

CVSS v3.1

HIGH

Patch availableGet patch

Description

Microsoft Exchange Online Elevation of Privilege Vulnerability. Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

Affected Products

Microsoft Exchange Online

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C