Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-59115: Microsoft Entra Provisioning Service Privilege Elevation Risk
CVE-2026-59115 · published 28 days ago
Summary
An authorized attacker can use a specific path in Microsoft Entra Provisioning Service to gain more access than they should have over a network. This could potentially allow them to make changes or access sensitive information. Microsoft should be contacted to verify if this issue affects your specific installation and to receive guidance on how to mitigate the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft entra provisioning service | - |
| microsoft | entra_provisioning_service |
All versions
cpe:2.3:a:microsoft:entra_provisioning_service:-:*:*:*:*:*:*:* |
Original advisory text
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
Severity
9.9
Critical
CVSS 3.1: 9.9 (NVD)
Exploitation
EPSS <1%
Type
CWE-35Path Traversal: '.../...//'
Timeline
Published6 Aug 2026
Updated3 Sep 2026
First seen7 Aug 2026
Monitor software like this
Free during beta