Sometimes the patch lands before the CVE hits your ticket queue. Microsoft Security Response Center published CVE-2026-62916 on 3 September 2026 as a Microsoft Entra ID elevation of privilege vulnerability. The advisory's operative sentence is the whole story: this vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of the CVE is further transparency. Sunday 6 September. Worth saying plainly: the cloud identity plane got a server-side fix without asking every customer to schedule a change window.

Tap to enlarge