EUVD-2026-63692
GHSA-cwh9-8jgj-qpcf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable SSRF needing only low-privilege authenticated access (PR:L), no user interaction, and an SSRF-driven scope change (S:C) enabling full CIA impact, consistent with vendor 9.9.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft Entra ID (formerly Azure Active Directory) allows an authenticated, low-privileged attacker to abuse a server-side request forgery flaw (CWE-918) to reach protected internal endpoints and escalate privileges across a security scope over the network. The flaw carries a critical CVSS 9.9 with a scope change, meaning a foothold in one context can be leveraged to compromise resources beyond the attacker's original authorization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold valid, low-privileged authenticated access to Microsoft Entra ID (CVSS PR:L) and network reachability to the service (AV:N), with no user interaction needed (UI:N) and low attack complexity (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strongly consistent and point to a genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Because Microsoft Entra ID is a Microsoft-operated cloud service, the fix is deployed server-side by Microsoft (patch available per vendor advisory) and does not require customer-installed updates; review the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69851 to confirm your tenants are covered and whether any customer action is called out. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Verify your Entra ID tenant status in Azure Security Center to confirm Microsoft's service-side fix for CVE-2026-69851 has been applied, and review authentication logs for the past week for suspicious privilege escalation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Microsoft Entra
View allRemote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting ma
Server-side request forgery in Microsoft Entra ID Entitlement Management lets a remote, unauthenticated attacker coerce
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Privilege elevation in Microsoft Azure Active Directory B2C (now part of Microsoft Entra) lets a remote, unauthenticated
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today