Patch Tuesday - September 2026
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
88
Vulnerability2 · 1 read
CVE-2026-83941
Missing Authorization in Microsoft Entra ID Enables Privilege Escalation
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p52
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-83941 is a missing-authorization flaw (CWE-862) in Microsoft Entra ID, the cloud identity service behind Microsoft 365 and Azure. An already-authenticated, low-privileged user can send a network request to an Entra ID endpoint that fails to enforce proper authorization checks, requiring no user interaction. Exploitation lets the attacker elevate their privileges within the directory, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Any organization that uses Microsoft Entra ID is in the affected population. The flaw was patched in Microsoft's September 2026 Patch Tuesday release; it is not in CISA KEV, has no known public proof-of-concept, and carries a low EPSS of roughly 0.7%.
What to do: Review Microsoft's September 2026 Patch Tuesday advisory for this CVE and apply any required tenant-side updates or configuration changes, noting that fixes for the cloud-hosted directory service are applied largely by Microsoft. Audit privileged role assignments and sign-in activity in your tenant for signs of unexpected elevation, and tighten who holds elevated roles. Monitor for additions to CISA KEV or public proof-of-concept code, which would raise urgency.
| Product | Affected |
|---|---|
| Microsoft Entra ID (Azure Active Directory) | — |
Estimated exposure
masshundreds of millions of user identities across hundreds of thousands of organizations (Entra ID underpins essentially all Microsoft 365/Azure tenants) — Entra ID is the default identity provider for Microsoft 365 and Azure, so virtually every organization using those platforms has tenants and users exposed to this flaw, though exploitation requires an attacker with existing low-privilege…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
In the news
4 storiesMicrosoft Patch Tuesday Update September 2026 – 974 Vulnerabilities Fixed, Including 2 Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities across Windows and Office, including two actively exploited Windows privilege-escalation zero-days.
88
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
82
The September 2026 Security Update Review
ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.
58