This vulnerability (CVE-2026-62873) in Microsoft 365 Admin Center is due to improper verification of cryptographic signatures (CWE-347). It enables an attacker to elevate privileges remotely over a network without requiring user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Since Microsoft 365 Admin Center is a cloud service, Microsoft manages the remediation server-side and has released an official fix.

An attacker exploiting this vulnerability can gain elevated privileges within the Microsoft 365 Admin Center environment, potentially compromising sensitive administrative functions and data. The impact includes full compromise of confidentiality, integrity, and availability of the affected service. No active exploitation has been reported yet.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft 365 Admin Center service. Administrators should ensure their environment is updated according to Microsoft's guidance. Since this is a cloud service, remediation is handled by Microsoft and no additional action is required by customers beyond applying updates or patches as directed by Microsoft.