EUVD-2026-73173
GHSA-22qv-2gmj-p6v2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Network-reachable IAM service exploitable by a low-privileged authenticated principal (PR:L) with no interaction; scope change (S:C) as Entra authorization impacts distinct tenant resources.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) allows an already-authenticated network attacker to gain elevated privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw lets a low-privileged principal act beyond its authorized role, with high confidentiality and integrity impact reaching resources outside the initially vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold low-level authenticated access to Entra ID (PR:L) - such as a standard user account, guest, or a service principal within a tenant - reachable over the network (AV:N) with no user interaction and low attack complexity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a genuinely high-priority issue but with an important caveat on real-world reach. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Because Entra ID is a Microsoft-operated cloud service, remediation is applied by Microsoft server-side and requires no customer patch - treat the primary action as confirming, via the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83941), whether the fix has rolled out to your tenant's cloud region and reviewing any customer guidance Microsoft publishes there. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: contact Microsoft support to confirm Entra ID remediation status and request audit logs for privilege escalation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today