CVE-2026-96207

CVE-2026-96207 is an improper certificate validation flaw (CWE-295) in Microsoft Partner Center. An unauthorized attacker on the network can exploit it without privileges or user interaction. Successful exploitation elevates privileges, with high impact to confidentiality and integrity and no stated availability impact; the changed scope means effects can extend beyond the vulnerable component. Microsoft partners and users of Partner Center are affected; no product version range was published. It is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Partners cannot patch this themselves because Partner Center is Microsoft-hosted. Watch the Microsoft Security Response Center and Partner Center Message Center for the vendor fix, enforce MFA and least-privilege roles on Partner Center accounts, and review recent role or trust changes for unexpected privilege elevation.