Microsoft Entra Id
13 CVEs affecting Microsoft Entra Id. Latest disclosed: 2026-09-03. Critical: 11, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-69836 | Critical | 10.0 | 2026-08-20 | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. |
CVE-2026-42901 | Critical | 10.0 | 2026-05-22 | Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-35431 | Critical | 10.0 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-55241 | Critical | 10.0 | 2025-09-04 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2026-69851 | Critical | 9.9 | 2026-08-20 | Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. |
CVE-2025-59246 | Critical | 9.8 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-59218 | Critical | 9.6 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2026-40379 | Critical | 9.3 | 2026-05-12 | Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-24305 | Critical | 9.3 | 2026-01-22 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2026-62916 | Critical | 9.1 | 2026-09-03 | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-33843 | Critical | 9.1 | 2026-05-22 | Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a n… |
CVE-2026-62869 | High | 8.8 | 2026-08-11 | Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network. |
CVE-2024-43477 | High | 7.5 | 2024-08-23 | Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on an… |