Reported by 2 outlets
CVE-2026-96207: Microsoft Partner Center improper certificate validation (CVSS 10)
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.03 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.2 / 10 = base × recency + community
Analysis
Microsoft's October security bundle includes CVE-2026-96207 (CVSS 10.0), an improper certificate validation flaw in Partner Center enabling remote privilege escalation. The same cycle covers a 9.9 authorization bypass in Microsoft Bookings (CVE-2026-94510) and two unauthenticated RCEs in Azure App Service (CVSS 9.8). Apply patches immediately; these are critical remote-access vulnerabilities with no confirmed in-the-wild exploitation reported yet.
Timeline
-
original reporting
CVE-2026-96207 (CRITICAL, CVSS 10) affects Microsoft Partner Center: improper certificate validation (CWE-295) allows remote privilege escal
radar.offseq.com · 5d ago · October 9th, 2026
CVE-2026-96207 (CRITICAL, CVSS 10) affects Microsoft Partner Center: improper certificate validation (CWE-295) allows remote privilege escal
via Mastodon https://radar.offseq.com/threat/cve-2026-96207-cwe-295-improper-certificate-validation-in-microsoft-microsoft-partner-center-0f13dc5f1a15e1f3
-
update from threataft.com
Microsoft October bundle — CVSS 10.0 cert bypass in Partner Center, 9.9 authz bypass in Bookings, two unauth RCEs at 9.8 in Azure App Servic
threataft.com · 5d ago · October 9th, 2026
Microsoft October bundle — CVSS 10.0 cert bypass in Partner Center, 9.9 authz bypass in Bookings, two unauth RCEs at 9.8 in Azure App Servic
via Mastodon https://threataft.com/articles/microsoft-october-2026-bundle-partner-center-bookings-azure