AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-57100

Microsoft Entra Provisioning Service: server-side request forgery

Microsoft

CVE-2026-57100 · Published Jul 2, 2026 · updated Jul 8, 2026

Critical9.9
No fix yet
Microsoft advisory

Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

Affected versions

PackageAffectedFixed in
Microsoft Entra Provisioning Service
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More Microsoft advisories

All Microsoft
High 8.8Jul 3Microsoft Edge (Chromium-based): integer overflowCVE-2026-57974fixed in 150.0.4078.48Critical 9.9Jul 2Microsoft Azure Open AI: server-side request forgeryCVE-2026-45499no fix yetHigh 8.8Jul 2Microsoft Exchange Online: improper authorizationCVE-2026-54998no fix yetCritical 9.3Jul 2Microsoft 365 Copilot: open redirectCVE-2026-41106no fix yetMedium 4.8Jul 2Microsoft Azure Synapse: improper access controlCVE-2026-26145no fix yetHigh 8.3Jul 1Microsoft Edge (Chromium-based): use after freeCVE-2026-50521fixed in 149.0.4022.68