Microsoft disclosed a critical (CVSS 9.9) missing authorization vulnerability in Entra ID that lets an authenticated attacker escalate privileges across a trust boundary over the network.
What Is It
CVE-2026-83941 is a missing authorization weakness (CWE-862) in Microsoft Entra ID. Per Microsoft's description, the flaw "allows an authorized attacker to elevate privileges over a network." The CVSS 3.1 vector, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, scores 9.9 CRITICAL: exploitable remotely, low attack complexity, no user interaction, and only low privileges required. The scope is CHANGED, meaning successful exploitation reaches resources beyond the initially compromised security context.
Why It Matters
The combination of network reach, low privilege requirements, and no user interaction makes this a low-barrier path to privilege escalation. The impact profile is high confidentiality and high integrity loss with low availability impact, and the changed scope indicates the attacker crosses an authorization boundary rather than staying confined to their own context. Entra ID is an identity provider, so privilege escalation there has downstream consequences for anything relying on it for authentication and authorization.
The CVE record was published 2026-09-08 and is currently marked "Awaiting Analysis" by NVD. No CISA KEV entry accompanies this record, so there is no confirmed evidence of active exploitation in the supplied data.
What's Vulnerable
- Vendor: Microsoft
- Product: Microsoft Entra
- Affected versions: listed as
-(all / not version-scoped)
Microsoft tags this CVE as exclusively-hosted-service, indicating the affected component is a Microsoft-operated cloud service rather than customer-deployed software. No CPE entries are published in the NVD record.
Patch Status
No remediation steps, patch identifiers, or required-action deadlines are present in the supplied source data. Because the vulnerability is tagged as an exclusively hosted service, remediation is generally handled on the provider side rather than through customer-installed updates. Consult the Microsoft Security Response Center advisory below for the authoritative servicing status.