EUVD-2026-54317
GHSA-w2pm-fvgr-6r6g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable provisioning service needing only a low-privileged authorized identity (PR:L), low complexity, no interaction, with a traversal-driven scope change (S:C) yielding full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in the Microsoft Entra Provisioning Service (SyncFabric) allows an already-authorized, low-privileged network attacker to elevate privileges via a path-traversal sequence ('.../...//'), with a scope change (S:C) that lets impact cross into other security domains such as the underlying identity/provisioning tenant. Rated CVSS 9.9, the flaw yields high confidentiality, integrity, and availability impact and requires no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold some low-level authorization to the Microsoft Entra Provisioning Service (SyncFabric) - CVSS PR:L confirms a valid low-privileged identity/role or service principal is a prerequisite, so this is not an unauthenticated attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) signals a genuinely severe, network-reachable, low-complexity issue that needs only some existing low-level authorization and no user interaction, with a scope change amplifying impact - the profile that warrants urgent attention. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds a low-privileged authorized role or service principal within a tenant sends a crafted request to the Entra Provisioning Service containing a '.../...//' path-traversal sequence that defeats input sanitization. The traversal lets the request reference provisioning resources outside the attacker's authorized boundary, and the scope change enables elevation of privilege across that boundary, potentially exposing or modifying identity data. … |
| Remediation | This is a Microsoft-operated cloud service (Entra Provisioning Service / SyncFabric), so the fix is deployed by Microsoft on the server side and typically requires no customer patching action - Patch available per vendor advisory; consult the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59115 to confirm remediation and whether any tenant-side action is required. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Microsoft Entra SyncFabric deployments and restrict network access to provisioning endpoints through IP whitelisting and firewall rules, allowing only known administrative sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-35 – Path Traversal: '.../...//'
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today