CVE-2026-47655: Microsoft Graph Information Disclosure Vulnerability (CVSS 6.5)

Technical summary

CVE-2026-47655 is an information disclosure vulnerability in Microsoft Graph stemming from improper access controls (CWE-200). An authenticated attacker can exploit insufficient authorization checks to retrieve sensitive data that falls outside their intended permission scope. The attack vector is network-based with low complexity, requiring only valid API credentials and standard HTTP requests. The vulnerability does not enable data modification or service disruption—impact is strictly confidentiality.

Business impact

This vulnerability poses a data breach risk for organizations relying on Microsoft Graph for identity, calendar, email, and file-sharing APIs. A compromised service account, delegated admin token, or insider with minimal privileges could exfiltrate customer data, intellectual property, or personally identifiable information. The blast radius depends on the sensitivity of data accessible through Graph and the breadth of affected scopes. Regulatory implications may arise if exposed data includes regulated information (PII, HIPAA, PCI).

Affected systems

Microsoft Graph is affected. This API underpins Microsoft 365, Azure AD, Teams, Outlook, SharePoint, OneDrive, and other cloud services. Any application or service that authenticates to Graph using OAuth 2.0 tokens—including first-party Microsoft services and third-party integrations—is potentially impacted. The severity of exposure varies based on the specific data classes and API endpoints affected; verify Microsoft's advisory for scope details.

Exploitability

Exploitation requires valid authentication credentials, preventing unauthenticated attacks. However, the barrier is low once an attacker has a token: no special tricks, social engineering, or user interaction needed. Opportunistic attacks against over-privileged service accounts or compromised user sessions are realistic. The lack of public exploit code and KEV inclusion status (not on CISA's Known Exploited Vulnerabilities list as of publication) suggest active exploitation is not yet widespread, but the straightforward nature of access-control bypass makes rapid weaponization probable.

Remediation

Organizations must apply Microsoft's security update immediately to all systems exposing or consuming Microsoft Graph APIs. This includes patching Azure AD, Microsoft 365 tenants, and any custom applications using the Graph SDK. Concurrent actions: audit recently issued tokens for abuse, review access logs for unauthorized data queries, and enforce least-privilege access policies. Implement conditional access policies and monitor for anomalous Graph API usage patterns.

Patch guidance

Check Microsoft's official security advisory for the specific versions addressing CVE-2026-47655. Updates are typically deployed automatically to cloud services (Azure AD, Microsoft 365), but verify your tenant's last update timestamp. For on-premises deployments and third-party Graph consumers, manual patching may be required. Test patches in a non-production environment first, as Graph API changes can affect dependent applications. Coordinate with application owners to confirm compatibility.

Detection guidance

Monitor Azure AD sign-in logs and Graph API audit logs for authenticated users querying data outside their normal permission set. Flag requests to sensitive endpoints (users, mail, calendar, files) from service accounts or administrative tokens. Use Microsoft Defender for Cloud Apps or similar tools to detect anomalous Graph API activity. Search security logs for unusual token usage or repeated 403 Forbidden responses followed by successful queries to unexpected resources. Establish baseline usage profiles for key service accounts.

Why prioritize this

While CVSS 6.5 (MEDIUM) reflects the authentication requirement, organizations should treat this as high priority because: (1) Graph is fundamental to Microsoft 365 and Azure AD, affecting nearly all modern cloud deployments; (2) data exfiltration often goes undetected longer than active attacks; (3) insider and supply-chain risks are elevated; (4) rapid patch deployment is feasible for cloud-native tenants. Prioritize patching in environments with sensitive data or high-risk user populations.

Risk score, explained

The CVSS 6.5 score reflects a network-accessible vulnerability with low complexity and high confidentiality impact, moderated by the requirement for prior authentication (Privilege Required: Low). The vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates no user interaction, single-scope impact, and no availability or integrity loss. This places it firmly in MEDIUM territory; organizations should not dismiss it as low-risk.

Frequently asked questions