PT-2026-40242 · Microsoft · Sso Plugin For Jira & Confluence

Published 2026-05-12 · Updated 2026-05-25 · CVE-2026-41103

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SSO Plugin for Jira & Confluence (affected versions not specified)

Description An incorrect implementation of the authentication algorithm allows an unauthorized attacker to forge login responses and bypass Entra ID. This enables the attacker to impersonate any user and elevate privileges over a network. Millions of Atlassian organizations are potentially exposed.

Recommendations Apply the May 2026 Patch Tuesday updates.

Fix

RCE

Weakness Enumeration

CWE-303

Related Identifiers

BDU:2026-06865

CVE-2026-41103

Affected Products

Sso Plugin For Jira & Confluence

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-41103 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06865 · Security Note
• https://twitter.com/lyrie_ai/status/2054563984393867569 · Twitter Post
• https://canto.today/en/p/microsoft-patches-critical-netlogon-flaw-4s10r4 · Reddit Post
• https://twitter.com/CVEnew/status/2054341009744551999 · Twitter Post
• https://t.me/cveNotify/163721 · Telegram Post
• https://twitter.com/Trej0Jass/status/2055256645102694774 · Twitter Post
• https://twitter.com/byte_guard_blog/status/2054519832893104276 · Twitter Post
• https://twitter.com/pcasano/status/2054954604828528932 · Twitter Post
• https://twitter.com/ZeroDayFacts/status/2054428555493494894 · Twitter Post
• https://twitter.com/integ_sec/status/2058920521962582077 · Twitter Post
• https://twitter.com/dansantanna/status/2054304183713694053 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2054606921173180662 · Twitter Post