CVE-2026-48579: Microsoft Exchange Online Information Disclosure Vulnerability

Synopsis

An improper authorization vulnerability in Microsoft Exchange Online allows an unauthenticated attacker to reach the service over a network and disclose sensitive information or tamper with data. The CVSS score of 9.1 (Critical) reflects that no credentials or user interaction are needed, making the attack straightforward to execute at scale. Successful exploitation gives an attacker read access to confidential email data and the ability to modify it. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Microsoft publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Exchange Online service over the network; no local or physical access is needed, making internet-exposed deployments directly at risk.

• AuthenticationNot required

  No credentials of any privilege level are required; the vulnerability is exploitable by any unauthenticated party with network access.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker can exploit this entirely without user participation.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup to succeed.

Blast Radius

• Reads confidential email content, attachments, and mailbox metadata accessible through Exchange Online.
• Modifies or corrupts email data, including messages, calendar entries, or folder structures stored in affected mailboxes.
• Enables an attacker to exfiltrate sensitive business communications without leaving obvious authentication traces.
• Provides a foothold for further lateral movement by harvesting credentials, internal links, or organizational data embedded in email.