Microsoft Bookings had a serious authorization flaw: a low-privileged user (application) could act across tenant boundaries, turning a scheduling service into a privilege escalation path. CVE-2026-54998 was reported, fixed, and closed within 27 days.
How widespread is Microsoft 365 and its Exchange Online (mail service) around Swiss domains? To answer that question, I have analyzed a sample of around 24,000 Swiss .ch and related domains using public DNS records (MX), Microsoft AutodiscoverV2 endpoints. It should represent a snapshot of the Swiss mail landscape.
Finding a security vulnerability can be quite a story. In my case, it started with confusion when testing a feature or noticing something unexpected. After wider testing, you might confirm that something is broken or there could be an underlying issue. Then the real question kicks in: where do you report it, and how do you do it responsibly?
If you don't work in this space daily, you mostly hear about CVE's. But do you actually need one for every vulnerability, and how do you get it?