AI analysis
CVE-2026-85916 is a local information-disclosure flaw in Microsoft Azure Active Directory in which private personal information can be exposed to an unauthorized actor. An attacker with local access, and without prior privileges or user interaction, can disclose that information; the issue does not allow remote attack, integrity changes, or denial of service. Impact is limited to confidentiality and is rated high under CVSS 3.1 (base score 6.2, CWE-359). Organizations that use Azure Active Directory, now branded Microsoft Entra ID, are in scope, but exact affected builds were not listed with the October 2026 Patch Tuesday reference. It is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for Azure Active Directory / Microsoft Entra ID components as soon as they are available for your tenant and endpoints. Until patched, restrict local logon on devices that store or display directory identity data and review who has physical or interactive access to those systems. No public exploit is known, but treat any unexpected local access to identity caches or profiles as a potential disclosure event.
Affected
| Microsoft Azure Active Directory | — |
Estimated exposure
massHundreds of millions of Azure AD / Entra ID users potentially in scope, with local access required to exploit — Azure Active Directory (Microsoft Entra ID) is the identity service behind Microsoft 365 and Azure; Microsoft has publicly described it as serving on the order of hundreds of millions of users, though this flaw requires local access rather…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.