Is CVE-2026-48582 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48582 being exploited in the wild.

How severe is CVE-2026-48582?

Critical severity, with a CVSS score of 9.6, published 19 June 2026.

Which products and versions are affected?

Microsoft Exchange Online All versions.

Is there a fix for CVE-2026-48582?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48582 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-48582?

Check whether you run Microsoft Exchange Online at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48582: Microsoft Exchange Online privilege escalation via missing authorization

CVE-2026-48582 · Severity: critical · CVSS 9.6 · Published 2026-06-19

Microsoft Exchange Online, the cloud-based email and calendaring service, contains a security flaw that allows an existing user to gain unauthorized administrative permissions. By exploiting this weakness, an attacker with basic access to the organization's network can escalate their privileges to perform high-level actions they should not be allowed to do. This could lead to the unauthorized access of sensitive corporate emails, data theft, or full control over the organization's email environment.

Technologies: Microsoft Exchange Online. Vendors: Microsoft.

Quick answers

Is CVE-2026-48582 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48582 being exploited in the wild.
How severe is CVE-2026-48582?: Critical severity, with a CVSS score of 9.6, published 19 June 2026.
Which products and versions are affected?: Microsoft Exchange Online All versions.
Is there a fix for CVE-2026-48582?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48582 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-48582?: Check whether you run Microsoft Exchange Online at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in Microsoft Exchange Online due to missing authorization checks (CWE-862). An attacker who is already authenticated to the network with low-level permissions can exploit this flaw to gain elevated privileges. The vulnerability has a CVSS 3.1 score of 9.6, characterized by a network attack vector, low complexity, and a scope change, indicating that the attacker can impact components beyond the initial security scope. Successful exploitation allows for high confidentiality and integrity impacts. As this is a cloud-hosted service, Microsoft typically manages the deployment of fixes directly on the platform.

Affected products

Microsoft Exchange Online All versions

Timeline

2026-06-19: disclosed: Initial disclosure by Microsoft and NVD
2026-06-19: advisory

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48582

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.