CVE-2026-114162: Microsoft Graph Elevation of Privilege Vulnerability

Q: Who can exploit this vulnerability?

An attacker must already be authorized to use Microsoft Graph. The issue can be exploited over the network and does not require user interaction.

Q: What is the potential impact?

A successful attacker could elevate privileges. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the initially affected security authority.

Q: Which product is identified as affected?

The provided software information identifies Microsoft Azure Privileged Identity Management (PIM).

Q: Is there evidence of active exploitation?

The supplied severity vector marks exploit code maturity as unproven (E:U). No active-exploitation information is otherwise provided.

Published Nov 10, 2026

Updated

Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

Other sources

Microsoft Graph Elevation of Privilege Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Azure Privileged Identity Management (PIM)<2.0.32.2053

2.0.32.2053

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.32.2053

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:21 PM

Data Sourced

via MITRE·06:21 PM

DescriptionSeverity

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized to use Microsoft Graph. The issue can be exploited over the network and does not require user interaction.

What is the potential impact?

A successful attacker could elevate privileges. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the initially affected security authority.

Which product is identified as affected?

The provided software information identifies Microsoft Azure Privileged Identity Management (PIM).

Is there evidence of active exploitation?

The supplied severity vector marks exploit code maturity as unproven (E:U). No active-exploitation information is otherwise provided.

CVE-2026-114162: Microsoft Graph Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact?

Which product is identified as affected?

Is there evidence of active exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact?

Which product is identified as affected?

Is there evidence of active exploitation?