EUVD-2026-73173
GHSA-22qv-2gmj-p6v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Entra ID credentials
-
DeliverySend request to under-authorized endpoint
-
ExploitBypass missing authorization check
-
ExecutionElevate privileges in tenant
-
ImpactAccess/modify protected identity resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already be an authenticated principal within (or with access to) an Entra ID tenant - the CVSS PR:L confirms low-but-nonzero privileges are needed, so this is not anonymous internet exploitation. No user interaction is required (UI:N) and the vector is network-based (AV:N) with low complexity (AC:L). The limiting factor is the authentication prerequisite: an attacker must first obtain a valid low-privilege identity (compromised user account, guest account, or service principal). Because Entra ID is a Microsoft-operated multi-tenant cloud service, the affected code is centrally managed by Microsoft; the specific tenant configuration or feature that exposes the missing authorization check is not detailed in the advisory. |
| Impact | This is a genuine priority-worthy vulnerability but not an emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L), yielding full C:H/I:H/A:H impact - consistent with CWE-862 missing authorization enabling privilege elevation in a cloud identity platform. SSVC corroborates the severity with Technical Impact 'total' and Automatable 'yes', but crucially sets Exploitation to 'none', meaning CISA sees no evidence of exploitation. EPSS is low at 0.73% (52nd percentile), no CISA KEV listing, and no public POC - so despite the high impact, the current real-world exploitation likelihood is modest. The signals are internally consistent: high potential impact (a foothold identity account escalating to broad tenant privileges) tempered by an authentication prerequisite and no observed exploitation. Because Entra ID is a Microsoft-operated cloud service, the fix is almost certainly deployed server-side by Microsoft rather than requiring customer patching, which further reduces standing exposure. Treat as high-priority for awareness and detection review, not as an active-exploitation fire drill. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account or token in an Entra ID tenant (e.g., a compromised standard user or a guest/service principal) sends crafted requests to an Entra ID endpoint that fails to enforce proper authorization checks, elevating their effective privileges over the network. No public exploit code has been identified, and the attack requires prior authenticated access rather than being fully anonymous. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Missing authorization in Microsoft Entra ID allows an attacker who already holds a valid low-privilege identity - a compromised user account, guest account, or service principal - to elevate privileges over the network without any user interaction, giving high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Microsoft has published an advisory through MSRC (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83941), but no public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS is only 0.73% (52nd percentile), so this is a genuine priority-worthy finding rather than an emergency. Because Entra ID is a Microsoft-operated multi-tenant cloud service, the affected code is centrally managed and the exact tenant configuration or feature exposing the missing check is not detailed in the advisory.
Earlier versions of this analysis (1)
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) allows an already-authenticated network attacker to gain elevated privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw lets a low-privileged principal act beyond its authorized role, with high confidentiality and integrity impact reaching resources outside the initially vulnerable component. No public exploit identified at time of analysis; the issue is documented solely in Microsoft's MSRC update guide and is remediated by Microsoft server-side rather than by a customer-installed patch.
RemediationAI
There is no customer-installable patch for this issue: Entra ID is a Microsoft-operated multi-tenant cloud service, so remediation is applied server-side by Microsoft, and administrators should track the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83941) for confirmation of the service-side fix rather than looking for a downloadable version. Until that confirmation is available, the most effective compensating controls focus on shrinking the population of low-privilege principals and detecting post-compromise privilege escalation: tighten guest and external collaboration settings (restrict or disable guest invitations and B2B directory access - trade-off is friction for legitimate partner collaboration), enforce least privilege and eliminate standing privileged role assignments using Privileged Identity Management with just-in-time activation (trade-off is added approval latency for administrators), apply Conditional Access policies that require compliant/managed devices and MFA for role-bearing accounts and high-risk sign-ins (trade-off is potential lockout of legacy or unmanaged clients), and closely review Entra sign-in, audit, and directory-role change logs for anomalous role assignments or token activity with rapid session/refresh-token revocation for any account showing escalation indicators. Restricting network access to Entra administrative endpoints via named locations or private access is another option but offers limited value against an attacker already inside the tenant, since the vector is network-based with low complexity and no user interaction.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization) within Microsoft Entra ID, the cloud identity provider formerly known as Azure AD that acts as the authentication, token-issuance (OAuth/OIDC/SAML), directory-role, and RBAC control plane for Microsoft 365 and thousands of federated applications. A missing authorization check means a network-reachable service endpoint performs a privileged operation without verifying that the calling principal actually holds the required role or permission, typically because the check is enforced only in the UI or on the client side. The assessed vector AV:N/AC:L/PR:L/UI:N/S:U confirms the check is reachable over the network with low complexity and that the only real precondition is that the attacker must first possess some low-privilege principal - this is not anonymous internet exploitation, and no victim interaction is needed. Scope remains Unchanged, meaning the impact is confined to resources inside the affected Entra tenant (directory objects, roles, and the applications trusting that tenant). The CPE cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:* contains no version qualifier because Entra ID is delivered as a continuously updated SaaS platform, and neither the MSRC advisory nor the EUVD entry (EUVD-2026-73173) discloses the specific endpoint, API, or feature that lacks the authorization check.
Know when Entra Id gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable missing-authorization elevation needs an existing low-privilege identity (PR:L) with no user interaction (AC:L/UI:N), granting full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
A missing authorization check in Microsoft Entra ID, the Microsoft-operated multi-tenant cloud identity service used to govern access to corporate resources, allows anyone who already holds a valid low-privilege identity - a compromised user account, guest account, or service principal - to elevate to high privilege over the network with no user interaction. Because the flaw sits in the identity layer rather than a single application, the exposure is organizational: any team whose access depends on Entra ID could be affected if an attacker first obtains even a minor foothold. Microsoft has published an advisory, but no vendor patch is available yet and no public exploit code has been identified at time of analysis, so this warrants prioritized remediation rather than emergency escalation.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege by eliminating standing privileged role assignments in favor of just-in-time activation; restrict guest and service principal sign-ins with Conditional Access tied to trusted locations and applications; disable or delete unused guest accounts and service principals; rotate credentials and review permissions of service principals holding elevated rights; and monitor Entra ID audit and sign-in logs for anomalous role-assignment or privilege-escalation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authentication bypass in Microsoft Entra ID (CWE-306, missing authentication for a critical function) lets remote, unaut
Azure Entra ID Elevation of Privilege Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) lets a remote, unauthenticated attacker byp
Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege ne
Elevation of privilege in Microsoft Entra ID could enable an unauthenticated remote attacker to gain higher privileges,
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permission
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated at
Exploit-DB