CVE-2026-83941

Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in Microsoft Entra ID Elevates Privileges

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Microsoft Corporation

Description

Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-83941

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves a missing authorization check in Entra ID. An attacker who is already authorized can exploit this to gain higher privileges over the network.

Impact Analysis

An attacker could escalate their access rights, potentially taking control of sensitive systems or data. This could lead to data breaches, unauthorized modifications, or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR or HIPAA requirements for data protection and access controls.

Mitigation Strategies

Apply the latest security updates from Microsoft for Entra ID to address the missing authorization issue. Review user permissions and access controls to ensure least privilege principles are enforced.

Hi! I’m here to help you understand CVE-2026-83941. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70