CVE-2026-23663 Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability
An unauthorized attacker can elevate privileges in Microsoft Global Secure Access due to improper privilege management in Azure Entra ID.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23663?
CVE-2026-23663 is a high-severity vulnerability in Microsoft Global Secure Access (GSA), published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.
Weakness: CWE-269
Which versions are affected by CVE-2026-23663?
It affects 1 product.
Products include Microsoft Global Secure Access.
How do I fix CVE-2026-23663?
No fix has been published for CVE-2026-23663 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-23663 being exploited?
There is no known exploitation of CVE-2026-23663 in the wild and no public exploit code.
Sources
Also known as GHSA-qcvg-4gch-p3w8.