CVE-2026-57980

Received Received - Intake

Authentication Bypass via Alternate Path in Microsoft Edge

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: Microsoft Corporation

Description

Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-57980

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	edge	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to tamper with the application over a network by exploiting an alternate path or channel.

Impact Analysis

An attacker could exploit this to perform unauthorized actions or modify data within Microsoft Edge, potentially leading to data tampering or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access or tampering, which may violate compliance requirements for GDPR (data protection) and HIPAA (health information security).

Mitigation Strategies

Update Microsoft Edge to the latest version immediately to patch the authentication bypass vulnerability. Monitor network traffic for unusual activity and restrict unauthorized access to sensitive paths.

Hi! I’m here to help you understand CVE-2026-57980. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70