9.1 CriticalCWE-303
CVE-2026-41103
Microsoft Confluence SAML SSO plugin vulnerability
MicrosoftMicrosoft Confluence SAML SSO plugin
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.8%probability of exploitation in the next 30 days
Higher than 56% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.
Coverage 4 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 12 May · 18:10 UTC | SecurityWeek | Microsoft Patches 137 Vulnerabilities |
| Tue 12 May · 19:20 UTC | SANS ISC | Microsoft May 2026 Patch Tuesday, (Tue, May 12th) |
| Tue 12 May · 22:10 UTC | Krebs on Security | Patch Tuesday, May 2026 Edition |
| Wed 13 May · 02:31 UTC | Rapid7 | Microsoft Patch Tuesday patches Netlogon and DNS RCE flaws |
- Microsoft Patch Tuesday patches Netlogon and DNS RCE flawsRapid7 · mentions it in passing
- Patch Tuesday, May 2026 EditionKrebs on Security · mentions it in passing
- Microsoft May 2026 Patch Tuesday, (Tue, May 12th)SANS ISC
- Microsoft Patches 137 VulnerabilitiesSecurityWeek · first in our coverage