CVE-2026-41103: Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability
CVE-2026-41103 is an elevation of privilege vulnerability in Microsoft SSO Plugin for Jira & Confluence, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.1 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 5.38% probability of exploitation activity in the next 30 days, higher than 93% of all scored vulnerabilities. Microsoft released the fix on 12 May 2026 in the May 2026 Patch Tuesday. It affects 2 products in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-41103
- Severity
- Critical CVSS 9.1
- Microsoft severity
- Critical
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- More Likely
- Weakness
- CWE-303
- EPSS
- 5.38% (percentile 93%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2026 Patch Tuesday
- Product families
- Azure
From the May 2026 Patch Tuesday briefing
Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability
This critical CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) issue maps to incorrect implementation of an authentication algorithm (CWE-303). The vector indicates a remote, unauthenticated path to privilege gain, meaning an external attacker could potentially escalate from no access to authenticated/privileged access within the SSO-integrated Atlassian environment, depending on deployment.
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-41103 at 9.1 (temporal 7.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.
Frequently asked questions (Microsoft)
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could bypass authentication and gain unauthorized access to Jira or Confluence as a valid user. This may allow the attacker to view or modify content and perform actions with the same permissions as the compromised account, based on the authorization levels defined for that user within the Jira or Confluence server.
How could an attacker exploit the vulnerability?
An attacker could exploit this vulnerability by sending a specially crafted SSO response during the login process that tricks the system into accepting a forged identity, allowing the attacker to sign in without authenticating the user through Microsoft Entra ID.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and integrity (I:H), but could lead to no loss of availability (A:N). What does that mean for this vulnerability?
This means that an attacker who successfully exploits the vulnerability could access sensitive information and modify data within Jira or Confluence based on the authorization defined for the user in those servers but availability is not impacted because the vulnerability only allows an attacker to bypass authentication and act as a legitimate user, without providing any capability to disrupt, degrade, or take down the Jira or Confluence service itself.
Affected products (2)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft JIRA SAML SSO plugin | Release Notes | Security Update | 1.3.3 | No |
| Microsoft Confluence SAML SSO plugin | Release Notes | Security Update | 7.4.0 | No |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 9.1 (CRITICAL)
- NVD weakness
- CWE-303
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| confluence saml sso | before 7.4.0 |
| jira saml sso | before 1.3.3 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103 (Vendor Advisory)
Acknowledgments
- Robert Fitzpatrick with Microsoft
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |