cve-2026-41103

CVE-2026-41103 is a critical elevation-of-privilege vulnerability in the Microsoft SSO Plugin for Jira and Confluence, disclosed on May 12, 2026. With a CVSS score of 9.1, it allows an unauthenticated attacker to forge an SSO response and gain unauthorized access. The attack is network-accessible, low complexity, requires no privileges or user interaction. This vulnerability highlights the risk in identity plugins bridging Microsoft and collaboration software. Administrators should prioritize patching the Microsoft SSO Plugin to mitigate the threat.