LIVE FEED
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiperHardening a Personal Linux Server in an AfternoonMicrosoft 365 outage disrupts Outlook, Teams, and Copilot worldwideCheck Point patches zero-day root escalation flaw exploited against customersHackers Compromise 4,800 GitHub Accounts to Steal Cloud CredentialsHow to Put a Self-Hosted Service Behind SSO and Intrusion Blocking in an AfternoonBaker Tilly notifies clients of data breach at third-party provider
CRITICAL CWE-303

CVE-2026-41103

Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

Microsoft·Confluence SAML SSO plugin

9.1/ 10
CVSS 3.1
Critical severity
5.4%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 93% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
Published
May 12, 2026
Updated
Aug 10, 2026
First covered
Jun 29, 2026
Latest story
5 months ago

Summary

Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

CWE-303Incorrect Implementation of Authentication Algorithm

Attack profile

Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

Affected products

  • Microsoft Confluence SAML SSO plugin1.0.0 to before 7.4.0
  • Microsoft JIRA SAML SSO plugin1.0.0 to before 1.3.3

References

CVE.org recordcve.org NVD entrynvd.nist.gov Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerabilitymsrc.microsoft.com
Daily at 7:00 AM Eastern

The 0700 Brief

Every new security and AI story, summarised in one email. Confirm by email, unsubscribe in one click.

43 readers have subscribed