cbcvebase.
CVE-2026-41103
published 2026-05-12

CVE-2026-41103: Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a…

PriorityP270critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
5.38%
91.7th percentile
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

Affected

4 ranges
VendorProductVersion rangeFixed in
microsoftconfluence_saml_sso< 7.4.07.4.0
microsoftjira_saml_sso< 1.3.31.3.3
microsoftmicrosoft_confluence_saml_sso_plugin>= 1.0.0 < 7.4.07.4.0
microsoftmicrosoft_jira_saml_sso_plugin>= 1.0.0 < 1.3.31.3.3

Detection & IOCsextracted from sources · hover to see the quote

  • CVE-2026-41103 involves forged credential presentation to bypass Entra ID authentication in the Microsoft SSO Plugin for Jira & Confluence — monitor for authentication events where credentials are accepted for existing users but originate from unexpected sources or fail normal Entra ID token validation flows.
  • ·The vulnerability is in the Microsoft SSO Plugin for Jira & Confluence specifically — scope of affected deployments is limited to those products using this plugin for Entra ID-based SSO. Patches should be applied to all affected plugin versions.
  • ·Microsoft assessed exploitation of CVE-2026-41103 as 'more likely', indicating defenders should prioritize patching and monitoring for this vulnerability.
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.