Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-94510: Microsoft Bookings lets attackers gain higher access
CVE-2026-94510 · published 3 days ago
Summary
Microsoft Bookings contains a flaw that lets a user who should not have permission trick the system into thinking they are authorized. This can allow an attacker on the network to gain the same rights as an administrator or other privileged user. Apply the latest Microsoft updates or patches to fix the issue and limit network access to trusted accounts.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft bookings | - |
Original advisory text
Microsoft Bookings Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94510 vendor-advisory patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published8 Oct 2026
Updated10 Oct 2026
First seen8 Oct 2026
Track software like this
Free during beta