CVE-2026-85916

Analyzed Analyzed - Analysis Complete

Exposure of Private Data in Azure Active Directory

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description

Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85916

EUVD

EUVD-2026-99625

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_11_23h2	to 10.0.22631.7652 (exc)
microsoft	windows_11_23h2	to 10.0.22631.7652 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9711 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9711 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9711 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9711 (exc)
microsoft	windows_11_26h1	to 10.0.28000.3231 (exc)
microsoft	windows_11_26h1	to 10.0.28000.3231 (exc)
microsoft	windows_11_26h2	to 10.0.26300.9711 (exc)
microsoft	windows_11_26h2	to 10.0.26300.9711 (exc)
microsoft	windows_server_2025	to 10.0.26100.33650 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-359	The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Attack-Flow Graph

Executive Summary

This vulnerability involves the exposure of private personal information to an unauthorized actor within Azure Active Directory. An attacker could exploit this to disclose sensitive information locally on a system.

Impact Analysis

An unauthorized attacker may access and disclose your private personal information stored in Azure Active Directory. This could lead to identity theft, financial fraud, or privacy breaches depending on the exposed data.

Compliance Impact

This vulnerability could result in non-compliance with GDPR, HIPAA, or other privacy regulations due to unauthorized access and disclosure of personal data. Organizations may face legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest security updates from Microsoft to address the information disclosure vulnerability in Azure Active Directory. Monitor Microsoft's update guide for patches and verify installation on affected systems.

Hi! I’m here to help you understand CVE-2026-85916. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70