CVE-2026-26125
Published: 05 March 2026
Summary
CVE-2026-26125 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Microsoft Payment Orchestrator Service. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 36.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-26125 is a Payment Orchestrator Service Elevation of Privilege Vulnerability, published on 2026-03-05T23:16:20.160. It affects the Payment Orchestrator Service component and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). The vulnerability is linked to CWE-306 (Missing Authentication for Critical Function) with no additional CWE details from NVD.
An unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation enables privilege elevation, achieving high confidentiality impact within a changed scope, while integrity and availability remain unaffected.
The Microsoft Security Response Center provides an update guide with mitigation details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26125.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9890
Vulnerability details
Payment Orchestrator Service Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication (CWE-306) on a network-accessible Payment Orchestrator Service directly enables remote exploitation for privilege escalation (T1068) and can serve as an initial-access vector against a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly identifies and restricts critical actions performable without identification or authentication, addressing the missing authentication for the Payment Orchestrator Service critical function.
Requires unique identification and authentication for service users and processes, preventing unauthenticated exploitation of the Payment Orchestrator Service.
Enforces approved authorizations for access to system resources, blocking unauthenticated privilege elevation in the Payment Orchestrator Service.