CVE-2026-59115CRITICAL

CVE-2026-59115: Critical Microsoft Entra SyncFabric Flaw

A critical privilege escalation vulnerability in the Microsoft Entra Provisioning Service allows authorized attackers to gain elevated network access.

9.9/10 CVSS

What This Means

CVE ID: CVE-2026-59115
Description: '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
CVSS 3.1 score: 9.9 (CRITICAL), vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: 2026-08-07T00:16:33.780
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59115

How to Fix It

Apply the latest security updates from the Microsoft MSRC guide
Audit service account permissions for excessive privileges
Restrict network access to the Entra Provisioning Service
Monitor logs for unauthorized path traversal attempts

Source

NVD

Read our full coverage of CVE-2026-59115 →

Last updated August 7, 2026 UTC