This vulnerability, identified as CWE-35 (Path Traversal), affects Microsoft Entra Provisioning Service. It allows an attacker with some level of authorization to exploit a path traversal flaw using the sequence '.../...//' to elevate privileges remotely. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, and no user interaction required. Microsoft has published an official fix for this vulnerability.

Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected system due to privilege escalation. The attacker can gain elevated privileges over the network, potentially allowing unauthorized access to sensitive data or system functions.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59115 to remediate this vulnerability.