This vulnerability, identified as CWE-347, involves improper verification of cryptographic signatures within the Microsoft 365 Admin Center. An attacker exploiting this flaw can elevate privileges remotely over a network without requiring user interaction. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting its ease of exploitation and severe impact. Microsoft has released an official fix and, as this is a cloud service, remediation is managed by Microsoft. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62873.

Successful exploitation allows an unauthorized attacker to elevate privileges remotely, potentially gaining high-level access within the Microsoft 365 Admin Center. This impacts confidentiality, integrity, and availability of the service. No known active exploits have been reported.

Microsoft has provided an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Admin Center service. Administrators should ensure their service is updated according to Microsoft's guidance available in the vendor advisory. No additional action is required beyond applying the official fix.