Microsoft has disclosed a CVSS 9.9 path traversal flaw in the Entra Provisioning Service (SyncFabric) that lets an authenticated attacker escalate privileges across a security scope boundary over the network.
What Is It
CVE-2026-59115 is a path traversal vulnerability tracked as CWE-35 ("Relative Path Traversal: '.../...//'"). Per Microsoft's description, the '.../...//' sequence in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
The CVSS 3.1 base score is 9.9 (CRITICAL), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The exploitability subscore is 3.1 and the impact subscore is 6.0.
Why It Matters
The vector breaks down badly for defenders. Attack is over the network with low complexity, requires no user interaction, and needs only low privileges; meaning any account with minimal standing access is a viable launch point. Confidentiality, integrity, and availability impacts are all rated HIGH.
The critical detail is S:C, scope changed. The vulnerable component can affect resources beyond its own security authority, which is what pushes this to 9.9 rather than 8.8. In an identity provisioning service, that scope break is the difference between a contained bug and a tenant-level problem.
As of this writing, CVE-2026-59115 does not appear in CISA's Known Exploited Vulnerabilities catalog (linked below), and there is no public confirmation of active exploitation.
What's Vulnerable
Microsoft lists the affected product as Microsoft Entra Provisioning Service, with the version marked - (all). No CPE entries are published in the NVD record.
The CVE carries Microsoft's exclusively-hosted-service tag. This is a cloud service vulnerability, not shipped on-premises software; there is no version to inventory on your own infrastructure.
Patch Status
Because this is an exclusively hosted service, remediation is handled by Microsoft on the service side. No customer-installable patch is listed in the NVD record, and no required customer action or remediation deadline has been published.
The record is in Received status and has not yet been analyzed or enriched by NVD. Details may change. Consult the MSRC update guide entry below for Microsoft's authoritative advisory and any customer action guidance.
Sources
- NVD, CVE-2026-59115: https://nvd.nist.gov/vuln/detail/CVE-2026-59115
- Microsoft MSRC Update Guide; CVE-2026-59115: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59115
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog