Authentication Bypass via Alternate Path in Microsoft Entra ID
Microsoft Entra ID authentication bypass via alternate path lets unauthenticated attackers escalate privileges over a network. CVSS 9.1 critical. Patch available.
- Vendor
- Microsoft
- Product
- Microsoft Entra ID
- CVSS
- 9.1
- EPSS (exploit probability)
- 0.9%
- Status
- patched
- Published
Is CVE-2026-62916 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-62916 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-62916 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-62916 is a CVSS 9.1 critical authentication bypass (CWE-288) in Microsoft Entra ID, disclosed September 3, 2026. An unauthenticated remote attacker can reach a privileged Entra ID function through an alternate authentication path, bypassing the expected credential check and gaining elevated access over a network.
Microsoft has released a patch. Organizations using Entra ID should apply the update and review the MSRC advisory for affected configurations and patch scope.
This is the second critical authentication flaw in Entra ID in three weeks. CVE-2026-69836 scored CVSS 10.0 and reached CISA’s Known Exploited Vulnerabilities catalog in mid-August following confirmed active exploitation. CVE-2026-62916 has not been added to the KEV catalog as of September 5, 2026, and Microsoft’s advisory does not report confirmed exploitation in the wild.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 1.5% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 0.5% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 3.6% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2019-1068 Microsoft SQL Server Remote Code Execution Vulnerability | [ HIGH ] | 8.8 | 57.3% |
