CVE-2026-62873

This vulnerability is like a “forgery” mistake: the admin system doesn’t properly verify the proof it uses to trust requests, which can let an attacker pretend to be higher-privileged than they really are. If that happens, the attacker may be able to take control of administrative actions and potentially disrupt the service or access sensitive settings and data.

This matters if your business uses Microsoft 365 Admin Center or Windows Admin Center, especially if any admin features are reachable over a network. The vulnerability is designed to be triggered remotely rather than requiring a user to click anything, so attackers only need network reachability to the exposed admin surface.

This is RED because it has a critical impact profile (it can grant higher privileges remotely) and there is sustained press attention tied to a patch, including reporting associated with the Lazarus group. Even though there is no public exploit code recorded and it’s not listed in CISA KEV, the risk level is high enough that you should treat this as an urgent patching item now.

Confirm exposure

• Identify whether your organization runs Microsoft 365 Admin Center and/or Windows Admin Center.
• Confirm whether any admin functionality is reachable from outside your normal internal network (for example, via reverse proxies, published admin URLs, VPN-accessible management endpoints, or other network exposure).

Find the exact fixed version(s)

• Use Microsoft’s official MSRC guidance for CVE-2026-62873: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62873
• Compare the fixed update information in that page to what you currently run.
• Apply the fixed remediation Microsoft lists for your specific branch/version (Microsoft’s guidance is the source of truth for exact version numbers).

Upgrade/patch

• Roll out Microsoft’s fix to the impacted components (Microsoft 365 Admin Center and/or Windows Admin Center) according to your normal change window.
• If patching is delayed, do not leave internet-facing admin endpoints exposed; remove public reachability and ensure only approved internal/VPN access paths remain.

Post-patch verification

• Confirm the patched update is installed (per Microsoft’s verification steps on the MSRC page, if provided).
• Validate that your admin center functions still work normally for legitimate users.

What to monitor

• Look for unusual admin-center activity around the time of exposure, such as:
  • changes to roles/permissions,
  • creation of unexpected admin accounts,
  • repeated failed or atypical admin requests,
  • sudden changes in administrative configuration.

KEV timing

• This CVE is not listed in CISA KEV based on the provided findings, so follow MSRC’s patch guidance as the primary timeline rather than KEV-based urgency.

Summary

CVE-2026-62873 is a Microsoft 365 Admin Center elevation of privilege vulnerability (CWE-347) driven by improper verification of a cryptographic signature. The impact is significant because it enables an unauthorized remote attacker to gain higher permissions.

Exploit status

• No public exploit code is on record (per findings).
• Not listed in CISA KEV (per findings).
• Reported attacker activity/attention: press attention is sustained, and the actor associated in the findings is the Lazarus group.

Attack vector and trigger (high-level)

The weakness is tied to how the admin center verifies trusted cryptographic material. An attacker can attempt to supply/cause requests that pass incorrect verification logic, resulting in elevated privileges without requiring user interaction.

Risk signals from findings

• Patch is available via MSRC (fix information referenced in findings).
• EPSS is a prediction and is flat in trend; since KEV is not present and exploitation evidence is limited to “press attention,” remediation should still be treated as urgent due to the critical privilege escalation potential and the availability of a vendor fix.

What KEV means here

KEV listing is a “known being exploited” signal. Since it is not listed in KEV per the findings, exploitation is not confirmed through that channel; however, the critical nature of the privilege escalation and sustained attention still justify immediate patching.