CVE-2026-83711criticalCWE-639

CVE-2026-83711: critical vulnerability in Microsoft Entra

Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

Published · Updated

Follow this CVE+ Monitor Microsoft Entra

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert.

ssvc Trackcvss 10epss 0.8%
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Entra
Related CVEs — Microsoft Entra

In the same product, most dangerous first.

CVE-2024-21401CRITICALMicrosoft Entra Jira Single-Sign-On Plugin Elevation of Privilege VulnerabilityEPSS 1.5%CVE-2024-21381MEDIUMMicrosoft Azure Active Directory B2C Spoofing VulnerabilityEPSS 0.4%