This vulnerability, identified as CVE-2026-48579 and classified under CWE-285 (Improper Authorization), affects Microsoft Exchange Online. It enables an attacker without proper authorization to access and disclose information over a network. The CVSS 3.1 base score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. Microsoft has published an official fix for this vulnerability, as detailed in their security advisory.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information in Microsoft Exchange Online environments. The integrity of data could also be compromised. There is no indication of availability impact. No known exploits are currently reported in the wild.

An official fix is available from Microsoft. Users and administrators of Microsoft Exchange Online should promptly apply the security update as outlined in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48579. Since this is a cloud service, remediation is managed by Microsoft, but customers should verify that updates have been applied or enforced.