Microsoft Entra vulnerabilities

Latest Microsoft Entra CVEs

Newest publication first

1. CVE-2026-83941 Entra ID Elevation of Privilege Vulnerability

   Published 2026-09-08

   High·CVSS 8.8 EPSS 0.78%

   Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

2. CVE-2026-62916 Microsoft Entra ID Elevation of Privilege Vulnerability

   Published 2026-09-03

   Critical·CVSS 9.8 EPSS 0.87%

   Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

3. CVE-2026-69851 Microsoft Entra ID Elevation of Privilege Vulnerability

   Published 2026-08-20

   Critical·CVSS 9.9 EPSS 0.78%

   Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

4. CVE-2026-69836 Microsoft Entra ID Remote Code Execution Vulnerability

   Published 2026-08-20

   Critical·CVSS 10.0 EPSS 1.8%

   Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

5. CVE-2026-62869 Azure Entra ID Spoofing Vulnerability

   Published 2026-08-11

   High·CVSS 8.8 EPSS 0.44%

   Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.

6. CVE-2026-42901 Microsoft Entra ID Elevation of Privilege Vulnerability

   Published 2026-05-22

   Critical·CVSS 10.0 EPSS 0.30%

   Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

7. CVE-2026-33843 Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

   Published 2026-05-22

   Critical·CVSS 9.8 EPSS 0.47%

   Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

8. CVE-2026-40379 Azure Entra ID Spoofing Vulnerability

   Published 2026-05-12

   High·CVSS 7.5 EPSS 0.91%

   Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.

9. CVE-2026-35431 Microsoft Entra ID Entitlement Management Spoofing Vulnerability

   Published 2026-04-23

   Critical·CVSS 10.0 EPSS 0.51%

   Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.

10. CVE-2026-24305 Azure Entra ID Elevation of Privilege Vulnerability

    Published 2026-01-22

    Critical·CVSS 9.8 EPSS 0.54%

    Azure Entra ID Elevation of Privilege Vulnerability

11. CVE-2025-59246 Azure Entra ID Elevation of Privilege Vulnerability

    Published 2025-10-09

    Critical·CVSS 9.8 EPSS 7.6%

    Azure Entra ID Elevation of Privilege Vulnerability

12. CVE-2025-59218 Azure Entra ID Elevation of Privilege Vulnerability

    Published 2025-10-09

    Critical·CVSS 9.6 EPSS 0.66%

    Azure Entra ID Elevation of Privilege Vulnerability

13. CVE-2025-55241 Azure Entra ID Elevation of Privilege Vulnerability

    Published 2025-09-04

    Critical·CVSS 9.8 EPSS 1.6%

    Azure Entra ID Elevation of Privilege Vulnerability

14. CVE-2024-43477 Microsoft Entra ID Elevation of Privilege Vulnerability

    Published 2024-08-23

    High·CVSS 7.5 EPSS 1.0%

    Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.