Microsoft Planetary Computer's Missing Authentication on a Critical Endpoint Allows Unauthenticated Attackers to Access and Execute Privileged Functions

Last refreshed2026-09-27

Status: UPDATED | Advisory ID: CVE-2026-63508

Key Details

CVE	CVE-2026-63508
CVSS Score / Version	10.0 (Critical) / CVSS v3.1
Updated	2026-09-20
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is none.
Affected products	Microsoft Planetary Computer
Classified as	CWE-306 (Missing Authentication for Critical Function)
Exploitation prediction (EPSS)	0.80% probability of exploitation in the next 30 days (55% percentile) -- FIRST.org's EPSS model.

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
Microsoft	Planetary Computer

Vendor

Product

Affected Versions

Patch Status

Microsoft

Planetary Computer

Subsystems	General OT
Sectors	Multiple

What to Know

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

What to Do

Monitor Microsoft's web page for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-63508
CVE	https://www.cve.org/CVERecord?id=CVE-2026-63508
Vendor advisory	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63508

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-63508

CVE

https://www.cve.org/CVERecord?id=CVE-2026-63508

Vendor advisory