Microsoft Graph vulnerabilities

4 CVEs affecting Microsoft Graph, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-49159, published 2026-07-24.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-49283, published 2023-12-05. Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days. microsoft-graph-core the Microsoft Graph Library for PHP. The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any…
• CVE-2023-49282, published 2023-12-05. Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days. msgraph-sdk-php is the Microsoft Graph Library for PHP. The Microsoft Graph PHP SDK published packages which contained test code that enabled the use of the phpInfo() function from any application…
• CVE-2026-49159, published 2026-07-24. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
• CVE-2026-47655, published 2026-06-04. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.