What is the CVSS score of CVE-2026-65673?

CVE-2026-65673 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Microsoft Entra Connect are affected by CVE-2026-65673?

Microsoft Entra Connect (versions 1.0.0-2.6.83.x) contains a privilege escalation vulnerability allowing low-privileged local users to achieve full system compromise.. A patch is available.

How to fix or mitigate CVE-2026-65673?

Within 24 hours, audit all Microsoft Entra Connect deployments to identify instances running versions prior to 2.6.84.0. Within 7 days, upgrade affected instances to version 2.6.84.0 or later, prioritizing production environments and validating directory synchronization after each upgrade. Within 30 days, complete deployment to all instances, audit local user access on Entra Connect servers, and implement access controls to restrict low-privileged user logons.

Microsoft Entra Connect CVE-2026-65673

EUVD-2026-56724 HIGH

SQL Injection (CWE-89)

2026-08-11 secure@microsoft.com

GHSA-m78c-8c5f-5prv

SQLi Microsoft Entra Connect

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Local attack vector and low privilege confirmed by product architecture; SQL injection under privileged service context yields full C/I/A impact with no user interaction required.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:30 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

CVET-EOP

AnalysisAI

SQL injection in Microsoft Entra Connect (versions 1.0.0 through below 2.6.84.0) enables local low-privileged users to escalate privileges on the host system, achieving full confidentiality, integrity, and availability impact. The CVSS vector (AV:L/PR:L) confirms that physical or remote shell access with a standard user account is the entry point - no administrative rights required to trigger the flaw. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact make this a credible lateral-movement or persistence risk in hybrid identity environments.

Technical ContextAI

Microsoft Entra Connect (formerly Azure AD Connect) is Microsoft's on-premises-to-cloud identity synchronization agent, widely deployed in enterprises maintaining hybrid Active Directory and Entra ID (Azure AD) environments. It maintains a local ADSync SQL database - either SQL Server Express LocalDB or a full SQL Server instance - to store synchronization state, connector space data, and configuration. CWE-89 (SQL Injection) indicates that one or more internal components that interact with this local SQL database fail to properly sanitize or parameterize input, allowing a local user to inject arbitrary SQL commands. Since the ADSync service and its database access typically run under a privileged service account (e.g., SYSTEM or a dedicated ADSync account), successful SQL injection can be weaponized to execute commands or access data at a privilege level far above the initial attacker foothold. Affected CPE covers Microsoft Entra Connect from version 1.0.0 up to (not including) 2.6.84.0.

RemediationAI

Upgrade Microsoft Entra Connect to version 2.6.84.0 or later, which contains the vendor-released patch per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65673. Until the upgrade can be applied, restrict local logon rights to the Entra Connect server to only designated synchronization administrators via Group Policy (User Rights Assignment: 'Allow log on locally' and 'Allow log on through Remote Desktop Services'), reducing the pool of users who could reach the vulnerable SQL interaction path. Additionally, audit and remove unnecessary local user accounts on the Entra Connect host. Note that restricting local logon does not eliminate the vulnerability - it only raises the bar for exploitation; patching remains the definitive fix. Do not expose the Entra Connect host to general-user interactive logon in any deployment posture.