Security Resilience

CVE-2026-54998

Access Control in Microsoft Exchange Online

Access Control
Published
02 July 2026
Modified
25 October 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0078 56th percentile
Risk Priority 65 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-54998 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Microsoft Exchange Online. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

CWE(s)
CWE-863

Related Threats

CVEs Like This One

CVE-2026-62872Same vendor: Microsoft
CVE-2023-28249Same vendor: Microsoft
CVE-2023-21719Same vendor: Microsoft
CVE-2025-21403Same vendor: Microsoft
CVE-2023-24880Same vendor: Microsoft
CVE-2023-24932Same vendor: Microsoft
CVE-2026-83792Same vendor: Microsoft
CVE-2026-70246Same vendor: Microsoft
CVE-2022-41091Same vendor: Microsoft
CVE-2023-21715Same vendor: Microsoft

Affected Assets

microsoft
exchange online
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

AC-3 Access Enforcement good match

AC-3 directly requires correct enforcement of authorization decisions on every access request, structurally preventing incorrect checks.

AC-24 Access Control Decisions good match

AC-24 ensures access-control decisions are made and applied consistently, reducing the chance of an incorrect authorization result.

AC-25 Reference Monitor good match

A reference monitor that is always invoked and tamper-proof forces every authorization decision through a verified, correct path.

AC-6 Least Privilege partial match

Least-privilege assignments shrink the set of authorizations that must be checked correctly, limiting exposure to flawed checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.3 Information access restriction full match
blocks

A.8.3's access restriction mechanisms, including granular per-user and per-identity controls, directly enforce correct authorization checks, preventing exploitation of incorrect authorization flaws.

A.5.15 Access control partial match
blocks

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.

References