This vulnerability (CWE-345) in Microsoft Entra ID arises from insufficient verification of data authenticity, enabling an authorized attacker to spoof data over a network. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability with low attack complexity and no user interaction required. Microsoft has released an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62869.

An authorized attacker can exploit this vulnerability to spoof data over the network, potentially compromising confidentiality, integrity, and availability of the affected service. This could lead to unauthorized access or manipulation of data within Microsoft Entra ID environments.

Microsoft has provided an official fix for this vulnerability and manages remediation for Microsoft Entra as a cloud service. Administrators should verify that their environments are updated according to Microsoft's guidance in the vendor advisory. No additional action is required beyond applying the official fix as managed by Microsoft.