CVE-2026-65673 - Microsoft Entra Connect Elevation of Privilege Vulnerability

Back Back to CVE browser

HIGH

Microsoft Entra Connect Elevation of Privilege Vulnerability

Published Aug 11, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.32%

Description

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges locally.

Affected products

Vendor Microsoft Product Microsoft Entra Connect Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <2.6.84.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft Entra Connect

n/a

Version	Status	Constraints
1.0.0	affected	<2.6.84.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56724
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65673
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56724		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65673		vendor-advisorypatchVendor Advisory