CVE-2026-33843: Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Published May 21, 2026
·Updated
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
Other sources
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
— Microsoft
Affected Software
2 affected components
Microsoft Entra ID
Microsoft Entra ID
Event History
May 21, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·02:00 PM
Description
May 22, 2026
CVE Published
via MITRE·10:03 PM
Data Sourced
via MITRE·10:03 PM
DescriptionSeverity
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-33843?
The severity of CVE-2026-33843 is rated as critical with a score of 9.1.
2
What does CVE-2026-33843 affect?
CVE-2026-33843 affects Microsoft Azure Active Directory B2C, allowing for authentication bypass.
3
How do I fix CVE-2026-33843?
To fix CVE-2026-33843, ensure that you apply the latest security updates provided by Microsoft for Azure Active Directory B2C.
4
What could an attacker achieve by exploiting CVE-2026-33843?
An attacker exploiting CVE-2026-33843 could elevate privileges and gain unauthorized access to sensitive resources.
5
When was CVE-2026-33843 published?
CVE-2026-33843 was published on May 21, 2026.