MicrosoftCVE-2026-59115

Microsoft Entra Provisioning Service: privilege escalation

Critical9.9CVE-2026-59115 · Published Aug 7, 2026

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Microsoft Entra Provisioning Service Product	all versions	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-35

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Aug 7	Microsoft SharePoint Online: cross-site scripting Critical9.6Aug 7 CVE-2026-70332No fix yet	Critical9.6	No fix yet
Aug 7	Microsoft Azure Confidential Ledger: remote code execution Critical9.1Aug 7 CVE-2026-68823No fix yet	Critical9.1	No fix yet
Aug 7	Microsoft Teams: missing authorization Critical10.0Aug 7 CVE-2026-65667No fix yet	Critical10.0	No fix yet
Aug 7	Microsoft Purview eDiscovery: improper access control High8.8Aug 7 CVE-2026-65668No fix yet	High8.8	No fix yet
Aug 7	Microsoft 365 Admin Center: privilege escalation Critical9.8Aug 7 CVE-2026-62873No fix yet	Critical9.8	No fix yet
Aug 7	Microsoft Teams: improper authentication Critical9.6Aug 7 CVE-2026-62896No fix yet	Critical9.6	No fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.