CVE-2026-62916

CVE-2026-62916 is an authentication bypass (CWE-288) in Microsoft Entra ID, Microsoft's cloud identity and access management service, in which an alternate path or channel allows authentication checks to be circumvented. Per the CVSS vector, it is exploitable remotely over a network with no privileges and no user interaction required, by authenticating via an alternate path instead of the standard sign-in flow. A successful unauthenticated attacker gains the ability to elevate privileges, with high impact on confidentiality, integrity, and availability reflected in the 9.8 critical score. The affected population includes organizations relying on Entra ID, which is the default identity platform for Microsoft 365, Azure, and hybrid deployments; the available data does not specify affected versions or the specific sub-component involved. There is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in CISA's KEV; EPSS assigns a 0.6% probability of exploitation within 30 days.

What to do: Since Entra ID is a cloud service patched centrally by Microsoft, verify that the September 2026 security updates have been applied to your tenant and follow the Microsoft advisory for any tenant-side configuration or conditional access actions; no workarounds are documented in the available data. Review Entra ID sign-in and audit logs for unexpected privileged authentication activity, and re-check exposure after any additional Microsoft guidance on affected flows.