CVE-2026-62869 Azure Entra ID Spoofing Vulnerability
An authorized attacker can spoof identities in Azure Entra ID due to insufficient data authenticity verification, requiring a vendor patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62869?
CVE-2026-62869 is a high-severity vulnerability in Microsoft Entra, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.
Weakness: CWE-345
Which versions are affected by CVE-2026-62869?
It affects 1 product.
Products include Microsoft Entra Id.
How do I fix CVE-2026-62869?
No fix has been published for CVE-2026-62869 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-62869 being exploited?
There is no known exploitation of CVE-2026-62869 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Entra
- CVE-2026-69836 Microsoft Entra ID Remote Code Execution Vulnerability
- CVE-2026-42901 Microsoft Entra ID Elevation of Privilege Vulnerability
- CVE-2026-35431 Microsoft Entra ID Entitlement Management Spoofing Vulnerability
- CVE-2025-55241 Azure Entra ID Elevation of Privilege Vulnerability
- CVE-2026-83941 Entra ID Elevation of Privilege Vulnerability
Sources
Also known as GHSA-486h-mp6h-x926.