Microsoft Bookings Critical Elevation of Privilege Vulnerability Assigned CVE-2026-94510
A critical authorization bypass in Microsoft Bookings allows network-based attackers to elevate privileges, rated CVSS 9.9.
Key points
- Microsoft Bookings contains a critical elevation of privilege vulnerability, CVE-2026-94510.
- The flaw allows unauthorized attackers to bypass authorization via a user-controlled key.
- The vulnerability is rated CVSS 9.9 and is exploitable over a network.
Microsoft has disclosed a critical elevation of privilege vulnerability in Microsoft Bookings, designated as CVE-2026-94510. The flaw allows an unauthorized attacker to bypass authorization controls and elevate privileges over a network.
At a glance
- CVE
- CVE-2026-94510
- Product
- Microsoft Bookings
- CVSS
- 9.9 Critical
- Weakness
- insecure direct object reference
- Exploited
- No known exploitation
According to the Microsoft Security Update Guide, the vulnerability stems from an authorization bypass through a user-controlled key. This mechanism permits an attacker to gain higher-level access without proper authentication. The National Vulnerability Database (NVD) rates the severity of CVE-2026-94510 as Critical with a CVSS score of 9.9. The weakness is classified under CWE-639.
Context and Background
This disclosure appears amid a surge in high-severity vulnerability records. Our data desk analysis of public data shows that 514 new CVE records were published in the last 24 hours. Of these, 83 were rated CVSS 8.0 or higher, and 32 were rated 9.0 or higher.
Microsoft was among the top vendors for high-severity issues, with six new critical or high-rated vulnerabilities identified in this period. CVE-2026-94510 is one of three Microsoft Bookings-related vulnerabilities rated at 9.9 in this batch. Other high-severity entries included CVE-2026-96207 in Microsoft Partner Center (CVSS 10) and CVE-2026-106126 in Tenable Identity Exposure (CVSS 9.9). IBM also had significant exposure, with 29 high-severity records, including CVE-2026-14269 in DataPower Gateway and CVE-2026-84272 in Guardium Data Protection, both rated 9.8.
Who Is Affected
The vulnerability specifically affects Microsoft Bookings. Organizations using this service for scheduling and appointment management are potentially exposed to unauthorized privilege escalation. Because the attack vector is network-based, remote exploitation is possible. The NVD record confirms that Microsoft Microsoft Bookings is the affected component. No other products are listed in the advisory for this specific CVE.
What should you do?
Microsoft has not confirmed that a patch or fix is available yet. Administrators should monitor official channels for updates. In the interim, limit network exposure to Microsoft Bookings endpoints and enforce strict access controls. Review logs for unusual privilege escalation attempts. Once the vendor provides an update, apply it immediately to mitigate the risk.
What to do and how to stay safe: Microsoft
- Restrict network access to Microsoft Bookings services to authorized users and IP ranges only.
- Monitor authentication logs for anomalous privilege escalation attempts or unauthorized access patterns.
- Verify that all current Microsoft Bookings configurations adhere to the principle of least privilege.
- Await and apply the vendor-provided security update as soon as it becomes available.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-94510?
CVE-2026-94510 is a critical elevation of privilege vulnerability in Microsoft Bookings that allows unauthorized attackers to bypass authorization via a user-controlled key.
How severe is this vulnerability?
The National Vulnerability Database rates CVE-2026-94510 as Critical with a CVSS score of 9.9.
Is there a fix available?
No fix has been confirmed yet. Organizations should wait for an official update from Microsoft.
