Microsoft Patches Entra ID CVSS 9.1 Auth Bypass

Microsoft has patched CVE-2026-62916, a CVSS 9.1 critical authentication bypass in Entra ID. An unauthenticated remote attacker can exploit it to escalate privileges over a network. The MSRC advisory, published September 3, confirms a fix is available.

The underlying class is CWE-288: authentication bypass via alternate path or channel. The attacker reaches an Entra ID function through a route that skips the expected credential check, gaining elevated access without presenting valid credentials through the normal authentication flow.

This is the second critical Entra ID authentication flaw in three weeks. CVE-2026-69836 scored a perfect CVSS 10.0 and was added to CISA’s Known Exploited Vulnerabilities catalog in mid-August after confirmed exploitation in the wild. CVE-2026-62916 has not been added to the KEV catalog as of this writing, and Microsoft’s advisory does not report confirmed exploitation in the wild.

That absence from KEV affects triage priority, not the patch decision. A CVSS 9.1 unauthenticated privilege-escalation flaw in a cloud identity system is a high-priority update regardless of confirmed exploitation status.

Apply the update and review the MSRC advisory for scope details. Prioritize environments where Entra ID authenticates sensitive workloads or privileged access management. For related Microsoft security coverage from this month: Defender boot driver bypass and CoSnitch Copilot exfiltration research.