CVE-2026-62869

Microsoft Entra ID helps decide who you are when you sign in and which apps you’re allowed to use. This vulnerability is like a guard that doesn’t properly verify the identity “paperwork” it receives, so someone who has some credentials can potentially pretend to be another person or service. That can lead to unauthorized access and even disruptions, not just data theft.

This matters to you if your business uses Microsoft Entra ID (including Microsoft Entra) for sign-in, single sign-on, or access control to Microsoft 365, business apps, or internal systems. You should treat it as a risk if an attacker can reach Entra ID from the network with low-level authenticated capability, since the issue does not require the victim to click anything. Impact is especially relevant when the attacker can authenticate using stolen/abused credentials, such as compromised accounts, service principals, or integrations that can interact with Entra ID.

This is RED because the flaw can enable spoofing that undermines identity trust, and the remediation is being issued as a high-impact fix. While there’s no dated public report of active exploitation tied specifically to this CVE, security monitoring highlighted actor interest (Lazarus group), so you should assume motivated attackers may test or use it where credentials allow.