This vulnerability (CVE-2026-62873) in Microsoft 365 Admin Center is due to improper verification of cryptographic signatures (CWE-347). It enables an attacker to elevate privileges remotely without requiring user interaction. The issue affects the cloud service, and Microsoft has released an official fix to address it. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor manages patching for this cloud service, and users should refer to the Microsoft advisory for remediation details.

An attacker exploiting this vulnerability can gain elevated privileges remotely on the Microsoft 365 Admin Center, potentially compromising confidentiality, integrity, and availability of the service. This could lead to unauthorized administrative control over the affected environment.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Admin Center service. Administrators should ensure their environment is updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62873. No additional action is required beyond applying the official fix.