CVE-2026-56191: Exchange Online Auth Bypass Vulnerability

CVE-2026-56191 Overview

CVE-2026-56191 is an improper authentication vulnerability in Microsoft Exchange Online. An unauthorized attacker can perform tampering over a network without user interaction or prior privileges. The flaw is tracked as [CWE-287] Improper Authentication and carries a CVSS 3.1 base score of 10.0. The scope is marked as changed, indicating impact beyond the vulnerable component itself.

Microsoft published the advisory through the Microsoft Security Response Center (MSRC). Because Exchange Online is a cloud-hosted service, remediation is delivered by Microsoft directly rather than through customer-applied patches.

Critical Impact
An unauthenticated network attacker can bypass authentication in Microsoft Exchange Online and tamper with data, with confidentiality, integrity, and availability all rated High and a scope change to adjacent components.

Affected Products

Microsoft Exchange Online (cloud service)
CPE: cpe:2.3:a:microsoft:exchange_online:-:*:*:*:*:*:*:*
Tenants relying on Exchange Online authentication flows for mail, calendar, and directory-integrated services

Discovery Timeline

2026-07-24 - CVE-2026-56191 published to the National Vulnerability Database
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-56191

Vulnerability Analysis

The vulnerability stems from improper authentication in Microsoft Exchange Online. An attacker reaching the service over the network can bypass authentication controls and modify data that should be restricted to authorized principals. Microsoft's advisory classifies the issue as tampering, meaning integrity of mailbox or service data can be altered without valid credentials.

The scope change indicates that a successful attack affects resources beyond the initially vulnerable authentication component. This is consistent with authentication flaws in shared cloud services, where a bypass can influence adjacent tenants, mailboxes, or trust relationships. Confidentiality, integrity, and availability are all rated High.

EPSS currently places exploitation likelihood at roughly 0.667% with a percentile near 48, and no public exploit or CISA KEV listing is recorded at this time.

Root Cause

The root cause is a defect in how Exchange Online validates authentication for network requests. Under specific conditions, the service accepts requests that should have been rejected, allowing an unauthenticated caller to act as if authenticated. Microsoft has not published low-level technical details of the authentication flow involved.

Attack Vector

The attack vector is network-based with low attack complexity. No privileges and no user interaction are required. An attacker sends crafted requests to Exchange Online endpoints and abuses the improper authentication check to tamper with data or state. See the Microsoft CVE-2026-56191 Advisory for vendor guidance.

No verified proof-of-concept code is available. Technical exploitation details are not published in the referenced advisory.

Detection Methods for CVE-2026-56191

Indicators of Compromise

Unexpected mailbox modifications, forwarding rule changes, or transport rule edits without a corresponding administrator sign-in event
Authentication events in Entra ID or Unified Audit Log that lack an associated user principal, token issuer, or client application ID
Anomalous Exchange Web Services (EWS), Graph, or Autodiscover requests from unusual IP ranges or user agents

Detection Strategies

Correlate Exchange Online audit records with Entra ID sign-in logs to surface tampering actions that have no matching interactive or non-interactive authentication
Monitor the Microsoft 365 Unified Audit Log for Set-Mailbox, New-InboxRule, Set-TransportRule, and delegation changes originating from unexpected sources
Baseline normal administrative activity per tenant and alert on deviations, particularly outside business hours or from new autonomous systems

Monitoring Recommendations

Ingest Microsoft 365 audit, Entra ID sign-in, and Exchange message trace logs into a centralized analytics platform for cross-source correlation
Enable mailbox auditing for all mailboxes and verify that AuditEnabled is set to true tenant-wide
Subscribe to the MSRC advisory for CVE-2026-56191 and track any additional guidance or IoCs released by Microsoft

How to Mitigate CVE-2026-56191

Immediate Actions Required

Review the Microsoft CVE-2026-56191 Advisory and confirm the current service status for your tenant
Audit recently created inbox rules, mail forwarding configurations, transport rules, and mailbox delegations for unauthorized changes
Rotate credentials and revoke refresh tokens for privileged accounts if suspicious tampering is identified
Enforce Conditional Access policies that require multi-factor authentication and compliant devices for Exchange Online access

Patch Information

Exchange Online is a Microsoft-managed cloud service. Microsoft applies fixes directly on the service side, and no customer-installed patch is required. Confirm on the MSRC advisory page that the vulnerability status is marked as mitigated for your tenant before closing related incidents.

Workarounds

Restrict legacy authentication protocols in Exchange Online where they are not required
Apply Conditional Access policies to block or challenge access from untrusted networks and unmanaged devices
Limit application permissions granted to third-party integrations that touch Exchange Online mailboxes
Enable and validate mailbox and admin audit logging so tampering is recorded even if authentication is bypassed

bash

# Verify tenant-wide mailbox auditing and review recent inbox rule changes
Connect-ExchangeOnline

Get-OrganizationConfig | Select-Object AuditDisabled

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) \
  -Operations "New-InboxRule","Set-InboxRule","Set-Mailbox","Add-MailboxPermission","Set-TransportRule" \
  -ResultSize 5000 | Export-Csv exo-tamper-review.csv -NoTypeInformation