CVE-2026-42901

Microsoft · Published May 21, 2026

10.0

CVSS v3.1

CRITICAL

Patch availableGet patch

Description

Microsoft Entra ID Elevation of Privilege Vulnerability. Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

Affected Products

Microsoft Entra ID

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C