CVE-2026-33843

—

CVSS 3.1

9.8 critical

EPSS

<1%p39

Published

May 22, 2026 (May 22, 2026)

Modified

Jul 23, 2026

Description

Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

Vendors: microsoft
Products: entra id
Weakness: CWE-288
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.