CVE-2026-26125 is a vulnerability in Microsoft Payment Orchestrator Service categorized under CWE-306 (Missing Authentication for Critical Function). It enables an attacker with network access and no privileges to elevate their privileges due to lack of proper authentication checks on critical functions. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an unauthenticated attacker to elevate privileges on the affected system, potentially gaining high-level access. Confidentiality impact is high, while integrity and availability impacts are not indicated. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26125 to remediate this vulnerability.