The Payment Orchestrator Service contains a flaw that enables an attacker to gain higher privileges than intended. The vulnerability is classified as CWE‑306, indicating that authentication requirements before authorization are missing or insufficient, allowing elevation of privilege. Attackers can potentially manipulate payment functions or access sensitive data. The precise mechanism is not disclosed, but the title suggests the flaw permits bypass of security controls within the service.

Microsoft Payment Orchestrator Service is impacted. No specific version information is listed in the CNA data, so all released versions may be susceptible until a patch is provided.

The CVSS score of 8.6 classifies the issue as high severity. EPSS is reported as less than 1 %, indicating a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not specified; it is inferred the flaw may involve inadequate authentication checks within the service, possibly exploitable by local or remote actors depending on configuration.