What is the CVSS score of CVE-2026-62869?

CVE-2026-62869 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Entra ID are affected by CVE-2026-62869?

Microsoft Entra ID is vulnerable to identity spoofing attacks by any user with a low-privilege account, enabling credential forgery and unauthorized access to organizational systems and data.

How to fix or mitigate CVE-2026-62869?

Within 24 hours, audit Entra ID logs for anomalous identity operations and review token generation events for suspicious activity patterns. Within 7 days, mandate multi-factor authentication for all Entra ID users and conduct an access review to revoke unnecessary low-privilege account permissions. Within 30 days, implement conditional access policies restricting sensitive identity operations, deploy continuous monitoring and alerting on authentication anomalies, and establish a vendor-advisory review cadence to enable rapid patch deployment once Microsoft releases a fix.

Entra ID CVE-2026-62869

EUVD-2026-56779 HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-08-11 secure@microsoft.com

GHSA-486h-mp6h-x926

Information Disclosure Microsoft Entra Id

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Cloud identity service reachable over network; low-privilege account required (PR:L); spoofing enabling full impersonation justifies C:H and I:H; A:H reflects admin impersonation enabling destructive tenant actions.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:10 vuln.today

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 8.8

DescriptionCVE.org

Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.

AnalysisAI

Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege network attacker to forge or manipulate identity data due to insufficient verification of data authenticity (CWE-345), yielding high confidentiality, integrity, and availability impact. The CVSS 8.8 score with PR:L confirms a valid tenant account is required but no elevated privileges are needed, meaning any compromised or legitimately provisioned low-privilege account could serve as a launchpad. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

CWE-345 (Insufficient Verification of Data Authenticity) describes a failure to adequately validate that data - such as tokens, assertions, or identity claims - originates from a trusted and unmodified source. Microsoft Entra ID is a cloud-based identity and access management platform used to authenticate users, issue OAuth/OIDC tokens, and enforce conditional access policies across Microsoft 365 and third-party SaaS integrations. The vulnerability likely resides in an authentication or token-validation pathway where the service accepts crafted or replayed identity material without sufficient cryptographic or contextual verification, allowing a low-privilege principal to present falsified identity attributes. No CPE strings were provided in the source data; affected scope is listed by EUVD as 'Microsoft Entra' without a discrete version bound, consistent with a cloud-service-side flaw rather than a versioned on-premises component.

RemediationAI

Because Microsoft Entra ID is a cloud-hosted service, the primary fix is applied server-side by Microsoft and typically requires no customer-initiated patching of an on-premises component. Organizations should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62869 to confirm whether any tenant-side configuration changes are recommended. As compensating controls while awaiting confirmation of remediation status: enforce Multi-Factor Authentication for all accounts via Conditional Access policies to reduce the impact of credential-level spoofing (trade-off: adds friction for end users); enable Entra ID Protection sign-in risk policies to detect anomalous authentication patterns that may indicate spoofed identity data; restrict application registrations and API permissions for low-privilege accounts to limit the blast radius of a spoofed low-privilege session; and review audit logs (sign-in logs, audit logs in the Entra portal) for unusual token issuance or service principal activity. No specific patched version number is available in the provided data - this is a cloud-service fix with version tracking handled by Microsoft.