CVE-2026-62916: CWE-288: Authentication Bypass Using an Alternate Path or Channel in Microsoft Microsoft Entra

This vulnerability (CVE-2026-62916) involves an authentication bypass in Microsoft Entra ID due to the use of an alternate path or channel. An attacker without prior privileges can exploit this flaw remotely to elevate their privileges. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Microsoft has issued an official fix for this vulnerability.

Successful exploitation allows an attacker to bypass authentication mechanisms and gain elevated privileges on the affected Microsoft Entra ID system over the network. This can lead to full compromise of the affected service's confidentiality and integrity, though availability impact is not indicated.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62916. No additional mitigations are specified beyond applying the official patch.