What is the CVSS score of CVE-2026-59115?

CVE-2026-59115 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Microsoft Entra are affected by CVE-2026-59115?

Microsoft Entra Provisioning Service (SyncFabric) contains a critical privilege escalation vulnerability (CVSS 9.9) that allows authenticated network users to bypass access controls and elevate…

How to fix or mitigate CVE-2026-59115?

Within 24 hours, inventory all Microsoft Entra SyncFabric deployments and restrict network access to provisioning endpoints through IP whitelisting and firewall rules, allowing only known administrative sources. Within 7 days, implement WAF or network-level path-traversal blocking rules targeting suspicious sequences ('...' patterns), establish real-time alerting for privilege escalation attempts and unauthorized access to provisioning service accounts, and disable or isolate any non-essential SyncFabric endpoints. Within 30 days, monitor Microsoft's security advisory channels for patch availability; upon release of a vendor patch, prioritize deployment within your change-control window given the critical CVSS 9.9 severity and absence of current workarounds.

Microsoft Entra CVE-2026-59115

EUVD-2026-54317 CRITICAL

Path Traversal: '.../...//' (CWE-35)

2026-08-07 secure@microsoft.com

GHSA-w2pm-fvgr-6r6g

Information Disclosure Microsoft Entra Provisioning Service

9.9

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.9 CRITICAL

Network-reachable provisioning service needing only a low-privileged authorized identity (PR:L), low complexity, no interaction, with a traversal-driven scope change (S:C) yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:32 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 9.9

DescriptionCVE.org

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in the Microsoft Entra Provisioning Service (SyncFabric) allows an already-authorized, low-privileged network attacker to elevate privileges via a path-traversal sequence ('.../...//'), with a scope change (S:C) that lets impact cross into other security domains such as the underlying identity/provisioning tenant. Rated CVSS 9.9, the flaw yields high confidentiality, integrity, and availability impact and requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority issue for the affected cloud service.

Technical ContextAI

SyncFabric is the backend engine behind the Microsoft Entra (formerly Azure AD) Provisioning Service, which automates creation, update, and deprovisioning of user/group identities across connected applications and directories. The root cause is CWE-35 (Path Traversal: '.../...//'), a variant where doubled dot-dot sequences and collapsed slashes survive naive sanitization: a filter that strips a single '../' can leave a residual '../' after collapsing '.../...//', letting the attacker escape an intended directory or resource boundary. In a multi-tenant provisioning service this traversal maps to accessing or manipulating provisioning artifacts/resources outside the caller's authorized path, which combined with the CVSS scope change (S:C) explains how a low-privileged actor reaches resources under a different security authority.

RemediationAI

This is a Microsoft-operated cloud service (Entra Provisioning Service / SyncFabric), so the fix is deployed by Microsoft on the server side and typically requires no customer patching action - Patch available per vendor advisory; consult the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59115 to confirm remediation and whether any tenant-side action is required. As compensating measures while validating exposure, apply least-privilege to provisioning/service principal accounts to shrink the pool of low-privileged identities meeting the PR:L precondition, review Entra provisioning and audit logs for anomalous cross-tenant or unexpected resource access, and enforce Conditional Access and network restrictions on administrative provisioning workflows; the trade-off of tightening provisioning permissions is potential disruption to automated user/group sync, so stage changes carefully. No exact fixed version number is provided in the input and none should be invented.