MicrosoftCVE-2026-65673
Microsoft Entra Connect: SQL injection
High7.8CVE-2026-65673 · Published Aug 11, 2026 · updated Aug 17, 2026
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges locally.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Microsoft Entra Connect Product | >= 1.0.0, < 2.6.84.0 | 2.6.84.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-89
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 11 | Copilot Chat Security Feature Bypass Vulnerability | High7.1 | 1.132.1 |
| Aug 11 | Copilot Custom Agent Hook Remote Code Execution Vulnerability | High7.8 | 1.132.1 |
| Aug 11 | Information disclosure vulnerability | Medium | 1.132.1 |
| Aug 11 | Fileless RCE in VS Code Web Remote Terminal via URL-Controlled NODE_OPTIONS | High8.8 | 1.132.1 |
| Aug 11 | Visual Studio Code web deployments - environmentService.ts - RCE via NODE_OPTIONS --import from URL payload | High8.8 | 1.132.1 |
| Aug 11 | TerminalInstance._createProcess - Workspace Trust bypass via terminal waitOnExit | High7.8 | 1.132.1 |