An improper certificate validation logic in Microsoft Partner Center permits an attacker, even without valid credentials, to elevate their privileges over the network. By manipulating the certificate chain presented to the service, the attacker can bypass authentication checks and gain higher‑level access, enabling the modification of partner relationships or viewing of sensitive configuration data, thereby compromising the confidentiality and integrity of Partner Center content.

The vulnerability applies to the Microsoft Partner Center service. Specific version information was not disclosed, so all deployments that are currently connected to the platform and have at least one authorized role are potentially affected.

The CVSS score of 9.6 classifies it as critical severity, indicating that a successful attack could lead to full control over the service. The EPSS score of less than 1% suggests that exploitation is currently rare, and it is not listed in the CISA KEV catalog. The most likely attack vector is through network traffic to the Partner Center service, exploiting the certificate validation flaw, which allows an attacker to gain elevated privileges without prior authentication. No additional prerequisites beyond the ability to communicate with Partner Center are mentioned.