This vulnerability (CVE-2026-21264) in Microsoft Account involves improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting). It enables an attacker to execute spoofing attacks remotely without privileges, requiring user interaction. The CVSS 3.1 base score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. Microsoft has published an official fix for this vulnerability.

Successful exploitation can lead to spoofing attacks that compromise user confidentiality and integrity of data within Microsoft Account services. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21264 to remediate this vulnerability.