CVE-2026-83941: Critical severity Microsoft Entra ID vulnerability
Published Sep 3, 2026
·Updated
Entra ID Elevation of Privilege Vulnerability
Other sources
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
1 affected component
Microsoft Entra ID
Event History
Sep 3, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·02:00 PM
Description
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must already be authorized, meaning they need an existing authenticated level of access to Entra ID. No user interaction is required, and exploitation can be performed over the network.
2
What is the potential impact if exploitation succeeds?
A successful attacker can elevate privileges. The supplied scoring indicates potential high impact to confidentiality and integrity, with low impact to availability, and that the impact can extend beyond the initially affected security authority.