Microsoft Entra vulnerabilities

CVE-2026-69836 [CRITICAL] CWE-502 CVE-2026-69836: Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute c Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

CVE-2025-59246 [CRITICAL] CWE-306 CVE-2025-59246: Azure Entra ID Elevation of Privilege Vulnerability Azure Entra ID Elevation of Privilege Vulnerability

CVE-2026-33843 [CRITICAL] CWE-288 CVE-2026-33843: Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C all Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-62916 [CRITICAL] CWE-288 CVE-2026-62916: Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorize Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-83941 [CRITICAL] CWE-862 CVE-2026-83941: Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

CVE-2026-69851 [CRITICAL] CWE-918 CVE-2026-69851: Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevat Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

CVE-2025-55241 [CRITICAL] CWE-287 CVE-2025-55241: Azure Entra ID Elevation of Privilege Vulnerability Azure Entra ID Elevation of Privilege Vulnerability

CVE-2026-24305 [CRITICAL] CWE-285 CVE-2026-24305: Azure Entra ID Elevation of Privilege Vulnerability Azure Entra ID Elevation of Privilege Vulnerability

CVE-2026-42901 [CRITICAL] CWE-346 CVE-2026-42901: Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-35431 [CRITICAL] CWE-918 CVE-2026-35431: Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthoriz Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-59218 [CRITICAL] CWE-284 CVE-2025-59218: Azure Entra ID Elevation of Privilege Vulnerability Azure Entra ID Elevation of Privilege Vulnerability

CVE-2026-62869 [HIGH] CWE-345 CVE-2026-62869: Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to pe Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.

CVE-2024-43477 [HIGH] CWE-284 CVE-2024-43477: Improper access control in Decentralized Identity Services resulted in a vulnerability that allows a Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant.

CVE-2026-40379 [HIGH] CWE-200 CVE-2026-40379: Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.