CVE-2026-21264: XSS in Microsoft Account

The primary impact of CVE-2026-21264 is the potential for attackers to execute malicious scripts within a user's browser while they are authenticated to their Microsoft Account. This can lead to various consequences, including session hijacking, credential theft, and redirection to phishing sites. An attacker could craft a malicious link or inject script into a legitimate Microsoft Account page, tricking users into executing the code. The scope of impact is broad, as any user accessing the affected Microsoft Account functionality could be vulnerable. Successful exploitation could compromise user data and potentially grant attackers access to sensitive information associated with the account.

1. Reserved2025-12-11
2. Published2026-01-22
3. Modified2026-04-01
4. EPSS updated2026-03-23

Currently, a specific fixed version of Microsoft Account is not available. Until a patch is released, users should exercise extreme caution when clicking links or interacting with content within their Microsoft Account. Consider enabling multi-factor authentication (MFA) on your Microsoft Account to add an extra layer of security. Monitor Microsoft's security advisories and apply the patch as soon as it becomes available. Web application firewalls (WAFs) configured to detect and block XSS payloads might offer some protection, but this is not a guaranteed mitigation.