CVE-2026-62916
CriticalCVSS 9.1Summary
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
Risk Assessment
An attacker may gain unauthorized access to resources protected by Microsoft Entra ID, potentially leading to organization-wide security breaches.
Recommendation
Apply patches from Microsoft and monitor for unusual authentication paths in Entra ID.
Other vulnerabilities in Microsoft Entra ID
See all- CVE-2026-69836Critical
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
- CVE-2026-42901Critical
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-32208High
A Cross-Site Scripting (XSS) vulnerability in Microsoft Entra ID allows an authorized attacker to perform spoofing attacks over a network. The flaw is caused by improper neutralization of input during web page generation.
Original NVD description (English source)
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.