Latest vulnerabilities for "microsoft entra id"

Where

Sort:

Microsoft dropped a CVSS 10.0 Entra ID RCE, said it was exploited, then walked that back a day later. No customer patch.

CVE-2026-69836, deserialization RCE in Entra ID. Microsoft says it was already fixed on their side. First advisory said exploited in the wild, next day that flag was gone.

Anyone actually change anything in those 24 hours, or just watch the advisory?

First published (updated )

Social

Microsoft Entra IDMicrosoft Entra ID Deserialization of Untrusted Data Vulnerability

Risk 100

Severity

Exploited

Trending

Month

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

1 / 3

Source: Microsoft

First published (updated )

CVE-2026-69836

Microsoft Microsoft Entra IDMicrosoft Entra ID Elevation of Privilege Vulnerability

Risk 82

Severity

9.9

SSRF

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Microsoft Entra ID Elevation of Privilege Vulnerability

1 / 2

Source: Microsoft

First published (updated )

CVE-2026-69851

Microsoft Entra IDAzure Entra ID Spoofing Vulnerability

Risk 79

Severity

8.8

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Azure Entra ID Spoofing Vulnerability

1 / 2

Source: Microsoft

First published (updated )

CVE-2026-62869

Microsoft Entra IDMicrosoft Azure Active Directory B2C Elevation of Privilege Vulnerability

Risk 86

Severity

9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

1 / 2

Source: Microsoft

First published (updated )

CVE-2026-33843

Microsoft Entra IDMicrosoft Entra ID Elevation of Privilege Vulnerability

Risk 87

Severity

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Microsoft Entra ID Elevation of Privilege Vulnerability

1 / 2

Source: Microsoft

First published (updated )

CVE-2026-42901

Microsoft Enterprise Security Token Service (ESTS)Azure Entra ID Spoofing Vulnerability

Risk 66

Severity

9.3

Infoleak

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

Azure Entra ID Spoofing Vulnerability

1 / 2

Source: Microsoft

First published (updated )

CVE-2026-40379

Microsoft Entra IDMicrosoft Entra ID Entitlement Management Spoofing Vulnerability

Risk 87

Severity

SSRF

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Microsoft Entra ID Entitlement Management Spoofing Vulnerability

1 / 2

Source: Microsoft

First published (updated )

CVE-2026-35431

Microsoft Entra IDAuthentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server…

Risk 61

Severity

9.8

EPSS

0.05%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).

First published (updated )

CVE-2026-3224