CVE-2026-32208
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability in Microsoft Entra ID allows an authorized attacker to perform spoofing attacks over a network. The flaw is caused by improper neutralization of input during web page generation.
Risk Assessment
An authorized attacker can exploit this vulnerability to display fraudulent content to users, potentially leading to credential theft or malware distribution.
Recommendation
Apply the security update provided by Microsoft for Microsoft Entra ID immediately. Additionally, implement input validation mechanisms and Content Security Policy (CSP).
Other vulnerabilities in Microsoft Entra ID
See all- CVE-2026-62916Critical
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69836Critical
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
- CVE-2026-42901Critical
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS