CVE-2026-57100

CriticalCVSS 9.9

Published: 02/07/2026(UTC)Updated: 08/07/2026(UTC)Translated: 09/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

46th percentile - higher than 46% of all known CVEs

Summary

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to escalate privileges over a network.

Risk Assessment

An attacker could exploit this vulnerability to send requests to internal network resources, potentially leading to unauthorized access to sensitive data or systems.

Recommendation

It is recommended to immediately apply security patches provided by Microsoft and restrict access to the service to trusted networks only.

Original NVD description (English source)

Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.