CVE-2026-48582Active Exploitation(microsoft / exchange_online)

MEDIUMCVSS 9.6 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch microsoft exchange_online systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

microsoft CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48582

Weakness type (CWE)

CWE-862

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

exchange_online

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-06-19); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

microsoft

Products

exchange_online

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d

Signal classification4 categories

Active Exploitation

125.0%

Disclosure

125.0%

General

125.0%

Patch

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-19	2	Active Exploitation1Disclosure1
2026-06-20	2	General1Patch1

Full discourse4 posts

ADK Cyber@ADKCyber90d
Patch
CVE-2026-48582 (CVSS 9.6): Missing authorization in Microsoft Exchange Online enables privilege escalation over a network. Review patches if using Exchange Online. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/6PUki7vOrN
Post summary
The post highlights a high‑score Microsoft Exchange Online flaw that allows privilege escalation and urges users to apply available patches.
0000066
92 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2026-48582 Privilege Escalation via Missing Authorization in Microsoft Exchange Online https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48582
Post summary
The text announces CVE-2026-48582 as a privilege escalation issue in Microsoft Exchange Online, but it provides no PoC, exploit code, active exploitation evidence, or patch information, leaving only a brief classification of the vulnerability type.
0000063
4.1K followersView on X
VulDB 🛡@vuldb91d
Active Exploitation
It is possible to see elevated activities targeting Microsoft Exchange Online (CVE-2026-48582) https://vuldb.com/vuln/372317/cti
Post summary
The post reports elevated activity targeting Microsoft Exchange Online linked to CVE‑2026‑48582, indicating possible active exploitation, but provides no PoC, exploit code, or patch details.
0000054
2.2K followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-48582 Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. https://www.cve.org/CVERecord?id=CVE-2026-48582
Post summary
CVE-2026-48582 is a privilege escalation vulnerability in Microsoft Exchange Online due to missing authorization, announced without a PoC, exploit, or patch details.
00000193
57.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	exchange_online	-	-	-

Explore more

Back to dashboard microsoft CVEs exchange_online vulnerabilities

What researchers are saying

CVE-2026-48582

ADK Cyber[verified]@ADKCyberPatch

The post highlights a high‑score Microsoft Exchange Online flaw that allows privilege escalation and urges users to apply available patches.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The text announces CVE-2026-48582 as a privilege escalation issue in Microsoft Exchange Online, but it provides no PoC, exploit code, active exploitation evidence, or patch information, leaving only a brief classification of the vulnerability type.

VulDB 🛡@vuldbActive Exploitation

The post reports elevated activity targeting Microsoft Exchange Online linked to CVE‑2026‑48582, indicating possible active exploitation, but provides no PoC, exploit code, or patch details.

CVE@CVEnewDisclosure

CVE-2026-48582 is a privilege escalation vulnerability in Microsoft Exchange Online due to missing authorization, announced without a PoC, exploit, or patch details.