An attacker can supply an invalid or forged certificate to Microsoft Partner Center because the system does not validate certificates properly. The flaw allows the attacker to elevate their privileges and gain administrative access over the network. This constitutes a complete compromise of the service’s access controls and enables an attacker to perform any operation the privileged user can.

Microsoft Partner Center is impacted. No specific software version or build numbers are disclosed in the available data.

The CVSS score of 10 indicates a critical severity, while the EPSS score is not available, so the current likelihood of exploitation is uncertain. The vulnerability is not yet listed in CISA’s KEV catalog. The lack of certificate validation implies that a remote attacker with network access or who can conduct a man‑in‑the‑middle attack could trigger the flaw. No additional prerequisites are documented; the description suggests that the attack vector is over a network connection to the Partner Center service.