Microsoft disclosed a critical authorization bypass in Azure Active Directory B2C that lets an unauthenticated attacker elevate privileges across a network, scoring a perfect 10.0 on CVSS 3.1.
What Is It
CVE-2026-83711 is an authorization bypass through a user-controlled key (CWE-639) in Microsoft Azure Active Directory B2C. Per Microsoft's description, the flaw "allows an unauthorized attacker to elevate privileges over a network." Microsoft has not published technical detail on the mechanism, but in the general CWE-639 pattern the authorization decision keys off a value the attacker supplies, which would suggest the identity service can be induced to grant access it should have denied. That reading is an inference from the weakness classification, not a vendor-confirmed attack path.
The CVE was published on 2026-09-03 by Microsoft ([email protected]) and is currently in "Received" status at NVD, meaning NVD analysis is not yet complete.
Why It Matters
The CVSS 3.1 base score is 10.0, CRITICAL, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. Every exploitability dimension is maxed: network attack vector, low complexity, no privileges required, and no user interaction. The exploitability subscore is 3.9, the highest possible.
The scope is CHANGED, which is what pushes this to a full 10.0. A successful attack breaches the security boundary of the vulnerable component and affects resources beyond it. For an identity platform, that most likely means impact reaching applications that rely on it for authentication, though Microsoft has not described the blast radius and the practical reach of a bypass into any given downstream application remains unconfirmed. Confidentiality and integrity impacts are both HIGH; availability is unaffected.
No CISA KEV entry for CVE-2026-83711 appears in the data reviewed for this brief, and no public exploitation reporting was identified. That is an absence of evidence rather than confirmation the vulnerability is unexploited; readers should check the KEV catalog and MSRC directly for current status.
What's Vulnerable
Microsoft lists the affected product as Microsoft Entra, version "-" (that is, no discrete version enumeration). The CVE carries the tag exclusively-hosted-service, indicating the vulnerable code runs in Microsoft's cloud rather than in customer-deployed software. No affected CPEs have been assigned.
Patch Status
No specific patch, build number, or required-action deadline appears in the supplied data. Given the exclusively-hosted-service tag, remediation for a cloud-hosted service is typically handled by the vendor rather than by customer patching; administrators should consult the MSRC Update Guide entry below for the authoritative servicing status and any customer action Microsoft specifies.
Sources
- NVD, CVE-2026-83711: https://nvd.nist.gov/vuln/detail/CVE-2026-83711
- Microsoft MSRC Update Guide; CVE-2026-83711: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83711
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog