CVE Intelligence
Analysis AI-assisted

CVE-2026-45480: Microsoft Azure Active Directory Improper Authentication Privilege Escalation

CVE-2026-45480 is an improper authentication weakness (CWE-287) in Microsoft Azure Active Directory that, according to the CNA description, allows an unauthorized attacker to elevate privileges over a network. The CNA rates it critical with a CVSS 3.1 base score of 10. The sources consulted do not list affected or fixed versions, and the CVE is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-45480 describes improper authentication (CWE-287) in Microsoft Azure Active Directory. The CNA, Microsoft Security Response Center, published the record on 2026-06-19 and assigned a critical severity with a CVSS 3.1 base score of 10.

Impact

  • According to the description, an unauthorized attacker with network access may be able to elevate privileges.
  • The CVSS vector indicates network attack vector, no privileges required, no user interaction, scope changed, and high confidentiality, integrity and availability impact.

Affected products and versions

  • Product listed: Microsoft Azure Active Directory.
  • Affected versions: not specified by the source. The record only states "versions not specified by the source".
  • Fixed versions: none listed in the record. The absence of listed fixes does not mean no fix exists; consult the vendor advisory.

Exploitation status

The CVE is not listed in CISA KEV, and no EPSS score is available. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the Microsoft Security Response Center update guide entry for this CVE and apply any vendor-provided update or service-side remediation that applies to your Azure Active Directory environment.
  • Review privileged role assignments and conditional access policies so that privilege changes are constrained while patching is in progress.
  • Follow the vendor guidance for any configuration steps; this portal does not provide them.

Detection guidance

  • Monitor directory audit logs for unexpected role assignments, privilege changes and sign-ins to privileged accounts.
  • Alert on administrative changes to group memberships and application permissions that do not match approved change records.

Limitations of the available information

  • Affected and fixed versions are unknown from the available record.
  • No EPSS score, SSVC data or KEV entry is available.
  • The technical root cause and exact conditions for exploitation are not described in the sources consulted.

Frequently asked questions

What is CVE-2026-45480?

It is an improper authentication weakness (CWE-287) in Microsoft Azure Active Directory that, per the CNA description, allows an unauthorized network attacker to elevate privileges.

Is CVE-2026-45480 being actively exploited?

It is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted.

Which versions are affected?

The sources do not specify affected or fixed versions. This is unknown from the available record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.