Is CVE-2026-56165 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56165 being exploited in the wild.

How severe is CVE-2026-56165?

Critical severity, with a CVSS score of 9.8, published 24 July 2026.

Which products and versions are affected?

Microsoft Account All versions.

Is there a fix for CVE-2026-56165?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56165 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56165?

Check whether you run Microsoft Account at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56165: Microsoft Account heap buffer overflow remote code execution

CVE-2026-56165 · Severity: critical · CVSS 9.8 · Published 2026-07-24

A critical vulnerability has been identified in the Microsoft Account service, which manages user authentication and identity across Microsoft platforms. An unauthorized attacker could exploit this flaw over the internet to execute malicious code on the system. This could lead to a complete compromise of the service, including unauthorized access to user data and disruption of authentication operations.

Technologies: Microsoft Account. Vendors: Microsoft.

Quick answers

Is CVE-2026-56165 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56165 being exploited in the wild.
How severe is CVE-2026-56165?: Critical severity, with a CVSS score of 9.8, published 24 July 2026.
Which products and versions are affected?: Microsoft Account All versions.
Is there a fix for CVE-2026-56165?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56165 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56165?: Check whether you run Microsoft Account at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as a heap-based buffer overflow (CWE-122) within the Microsoft Account service. The flaw allows an unauthenticated remote attacker to send specially crafted data over the network to trigger memory corruption. Successful exploitation enables arbitrary code execution with the privileges of the service. The attack requires no user interaction and has a low complexity, resulting in a critical impact on confidentiality, integrity, and availability. Microsoft has categorized this as an exclusively hosted service vulnerability, implying the fix is managed on the service provider side.

Affected products

Microsoft Microsoft Account All versions

Timeline

2026-07-24: disclosed: Initial publication of the CVE record.
2026-07-24: advisory: Microsoft Security Response Center advisory published.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56165

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.