CVE-2026-83711Disclosure(microsoft / azure_active_directory_b2c)

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

microsoft CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83711

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

azure_active_directory_b2c

Threat summary

Public PoC is present in monitored signal
6 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 4 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 1d ago at 5 mentions (2026-09-04); latest day: 1
6 total mentions across 2 days

Affected systems

Vendors

microsoft

Products

azure_active_directory_b2c

1 version affected across 1 product

Deep dive

Activity timeline6 mentions / 2d

Signal classification3 categories

Disclosure

466.7%

General

116.7%

PoC

116.7%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-04	5	Disclosure3General1PoC1
2026-09-11	1	Disclosure1

Full discourse6 posts

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs45d
Disclosure
CVE-2026-83711 Microsoft Entra ID B2C Authorisation bypass could allow unauthenticated privilege escalation in cloud identity deployments supporting public-facing authentication flows Analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-09-03/TIER_2_CVE-2026-83711.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
The post announces CVE‑2026‑83711, noting that an authorization bypass in Microsoft Entra ID B2C could enable unauthenticated privilege escalation, with a link to an analysis but no PoC, exploit, or mitigation details.
0101037
61 followersView on X
Kaitan ID Security@KaitanSecurity38d
Disclosure
⚡ Microsoft Azure: Two CVSS 10.0 Privilege Escalation Bugs Microsoft contributed two perfect-score elevation-of-privilege vulnerabilities this week. CVE-2026-70352 affects Azure AI Language, while CVE-2026-83711 targets Microsoft Azure…
Post summary
Microsoft announced two perfect‑score privilege‑escalation vulnerabilities (CVE-2026-70352 and CVE-2026-83711) affecting Azure AI Language and Azure services.
1000032
88 followersView on X
ExploitGrid@exploitgrid45d
PoC
[CVE] CVE-2026-83711 [HIGH PRIORITY] #Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability 🔗 https://exploitgrid.net/cve/CVE-2026-83711
Post summary
The post highlights CVE-2026-83711 and directly links to a site that likely contains a proof‑of‑concept, but it does not provide exploit code, active exploitation evidence, or any patch details.
1000047
40 followersView on X
ExploitGrid@exploitgrid45d
General
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-70352 CVE-2026-75754 CVE-2026-83711 CVE-2026-85061 CVE-2026-11613 ..🧵👇
Post summary
The post merely lists several CVE identifiers with no additional detail, which is typical of a general daily digest.
1000080
40 followersView on X
connect24h@connect24h45d
Disclosure
正直、この並びは背筋が冷える。 Microsoft MSRCに、Azure AI Language、Copilot Studio、Azure AD B2C、Entra IDのElevation of Privilegeが4件並んだ。CVE-2026-70352、CVE-2026-80098、CVE-2026-83711、CVE-2026-62916だ。単一欠陥の波及ではないが、MSRCの記載ではcryptographic signatureの検証不備、user-controlled keyによるauthorization bypass、alternate path／channelを使うauthentication bypassを含む。これ、AIサービスの認証をEntraへ寄せた構成ほど他人事に見えない。 CSIRT目線では、対象serviceの利用有無とservice principal、sign-in log、audit logを同じ時間軸で見られるかが初動の分かれ目になる。各CVEの攻撃条件と影響範囲は元ページで追いたい。認証は正面玄関より、脇道の棚卸しが難しい。 #セキュリソース: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70352
Post summary
The post announces four newly disclosed Azure AI EOP CVEs, gives brief technical details, but offers no PoC, exploit code, proof of wild use, or patch information.
00010360
6.9K followersView on X
ThreatAft@ThreatAft46d
Disclosure
🚨 AZURE ALERT — Two CVSS 10.0 Zero-Days CVE-2026-70352: Azure AI Language — missing auth → EoP CVE-2026-83711: Entra ID B2C — auth bypass → EoP → https://threataft.com/articles/azure-ai-language-entra-b2c-cve-2026-70352-cve-2026-83711 #cybersecurity #infosec #Azure #Microsoft #CVSS10 #ZeroDay #EntraID #ThreatIntel
Post summary
Alert announces two Azure Zero‑Day CVEs (CVE‑2026‑70352 and CVE‑2026‑83711) with CVSS 10.0, highlighting missing authentication and elevation of privilege issues and linking to an article for details.
1000077
42 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	azure_active_directory_b2c	-	-	-

Explore more

Back to dashboard microsoft CVEs azure_active_directory_b2c vulnerabilities

What researchers are saying

CVE-2026-83711

Kaitan ID Security[verified]@KaitanSecurityDisclosure

Microsoft announced two perfect‑score privilege‑escalation vulnerabilities (CVE-2026-70352 and CVE-2026-83711) affecting Azure AI Language and Azure services.

connect24h[verified]@connect24hDisclosure

The post announces four newly disclosed Azure AI EOP CVEs, gives brief technical details, but offers no PoC, exploit code, proof of wild use, or patch information.

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObsDisclosure

The post announces CVE‑2026‑83711, noting that an authorization bypass in Microsoft Entra ID B2C could enable unauthenticated privilege escalation, with a link to an analysis but no PoC, exploit, or mitigation details.

ExploitGrid@exploitgridPoC

The post highlights CVE-2026-83711 and directly links to a site that likely contains a proof‑of‑concept, but it does not provide exploit code, active exploitation evidence, or any patch details.

ExploitGrid@exploitgridGeneral

The post merely lists several CVE identifiers with no additional detail, which is typical of a general daily digest.

ThreatAft@ThreatAftDisclosure

Alert announces two Azure Zero‑Day CVEs (CVE‑2026‑70352 and CVE‑2026‑83711) with CVSS 10.0, highlighting missing authentication and elevation of privilege issues and linking to an article for details.