CVE-2026-42901
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
Risk Assessment
An attacker can escalate privileges within Entra ID, potentially leading to account takeover and access to cloud resources.
Recommendation
Apply the security update from Microsoft for Microsoft Entra ID.
Other vulnerabilities in Microsoft Entra ID
See all- CVE-2026-62916Critical
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69836Critical
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
- CVE-2026-32208High
A Cross-Site Scripting (XSS) vulnerability in Microsoft Entra ID allows an authorized attacker to perform spoofing attacks over a network. The flaw is caused by improper neutralization of input during web page generation.
Original NVD description (English source)
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS