Microsoft disclosed a critical (CVSS 9.1) authentication bypass in Microsoft Entra ID that lets an unauthenticated attacker elevate privileges over the network.
What Is It
CVE-2026-62916 is an authentication bypass using an alternate path or channel (CWE-288) in Microsoft Entra ID. Per Microsoft's description, the flaw "allows an unauthorized attacker to elevate privileges over a network." The CVE record was published on 2026-09-03 and is currently in "Received" status at NVD, meaning NVD analysis is not yet complete.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, giving a base score of 9.1 (CRITICAL) with an exploitability subscore of 3.9; the maximum. There is no availability impact, but confidentiality and integrity impact are both rated HIGH.
Why It Matters
Every exploitability dimension is at its worst value: reachable over the network, low attack complexity, no privileges required, and no user interaction. That combination means an attacker needs no foothold and no victim action to attempt exploitation.
Entra ID is an identity provider. An authentication bypass that yields privilege elevation in an identity layer is a bypass of the control that other systems depend on for their own access decisions, which is why the confidentiality and integrity impact is rated HIGH.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation and no KEV-mandated remediation deadline in the source material.
What's Vulnerable
Microsoft lists the affected product as Microsoft Entra, with the affected version recorded as -, a single, non-versioned entry. Microsoft has tagged the CVE exclusively-hosted-service, meaning the vulnerability exists in a service Microsoft operates rather than in software customers install and version themselves. No affected CPEs are enumerated in the NVD record.
Patch Status
Because this is tagged as an exclusively hosted service, there is no customer-installable patch listed in the supplied data. The only remediation reference provided is Microsoft's MSRC update guide entry. No required action, mitigation guidance, or fix timeline is present in the supplied KEV or NVD material; consult the MSRC advisory directly for current service status.
Sources
- NVD, CVE-2026-62916: https://nvd.nist.gov/vuln/detail/CVE-2026-62916
- Microsoft MSRC Update Guide; CVE-2026-62916: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62916