Microsoft Entra ID

productDE

cpe:/a:microsoft:entra:id

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

18critical8high2medium0low

updated 2026-10-28

vulnerabilities (46)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-54914US	critical9.8	2.51% (85th)	Exploit	no fix	2025-09-04	—
CVE-2026-69836US	—	1.53% (75th)	Exploit	no fix	2026-08-20	—
CVE-2026-24306US	—	0.85% (58th)	Exploit	no fix	2026-01-22	—
CVE-2025-55232US	—	2.13% (82nd)	—	no fix	2025-09-09	—
CVE-2025-55241US	—	1.61% (76th)	—	no fix	2025-09-04	—
CVE-2026-47299US	—	1.01% (63rd)	—	no fix	2026-08-11	—
CVE-2026-85917US	high7.5	0.97% (62nd)	—	no fix	2026-09-17	—
CVE-2026-62906US	high7.4	0.92% (60th)	—	no fix	2026-09-03	—
CVE-2026-24307US	high7.5	0.91% (60th)	—	no fix	2026-01-22	—
CVE-2026-70352US	critical10.0OT elevated	0.90% (60th)	—	no fix	2026-09-03	—
CVE-2026-62916US	critical9.8OT elevated	0.86% (58th)	—	no fix	2026-09-03	—
CVE-2026-65806US	—OT elevated	0.84% (58th)	—	no fix	2026-08-11	—
CVE-2026-50516US	—OT elevated	0.83% (57th)	—	no fix	2026-08-11	—
CVE-2026-69865US	critical10.0	0.80% (56th)	—	no fix	2026-09-17	—
CVE-2026-83711US	critical10.0	0.80% (56th)	—	no fix	2026-09-03	—
CVE-2026-70340US	high8.8OT elevated	0.80% (56th)	—	no fix	2026-08-11	—
CVE-2026-87701US	critical9.6	0.79% (56th)	—	no fix	2026-09-17	—
CVE-2026-85878US	critical9.9	0.78% (56th)	—	no fix	2026-09-18	—
CVE-2026-83941US	high8.8OT elevated	0.78% (56th)	—	no fix	2026-09-08	—
CVE-2026-69851US	—	0.78% (56th)	—	no fix	2026-08-20	—
CVE-2026-85889US	critical9.8OT elevated	0.67% (52nd)	—	no fix	2026-09-17	—
CVE-2026-24304US	critical9.9	0.67% (52nd)	—	no fix	2026-01-23	—
CVE-2025-55244US	—	0.64% (50th)	—	no fix	2025-09-04	—
CVE-2026-65818US	critical9.9	0.63% (50th)	—	no fix	2026-09-03	—
CVE-2026-70178US	high8.8OT elevated	0.63% (50th)	—	no fix	2026-09-03	—
CVE-2026-69857US	high8.8	0.63% (50th)	—	no fix	2026-09-03	—
CVE-2026-21524US	—	0.61% (49th)	—	no fix	2026-01-22	—
CVE-2026-21521US	—	0.61% (49th)	—	no fix	2026-01-22	—
CVE-2026-70200US	critical9.8	0.60% (49th)	—	no fix	2026-09-17	—
CVE-2026-21227US	critical9.8	0.57% (47th)	—	no fix	2026-01-22	—
CVE-2026-24305US	critical9.8	0.54% (45th)	—	no fix	2026-01-22	—
CVE-2026-68791US	high7.5OT elevated	0.54% (45th)	—	no fix	2026-09-17	—
CVE-2026-70009US	critical9.8	0.53% (45th)	—	no fix	2026-09-17	—
CVE-2026-35431US	—	0.51% (43rd)	—	no fix	2026-04-23	—
CVE-2026-80098US	critical10.0	0.49% (42nd)	—	no fix	2026-09-03	—
CVE-2026-69399US	critical9.8	0.48% (41st)	—	no fix	2026-09-17	—
CVE-2026-62869US	—OT elevated	0.44% (38th)	—	no fix	2026-08-11	—
CVE-2026-83944US	critical9.1	0.44% (38th)	—	no fix	2026-09-17	—
CVE-2026-21264US	medium6.1	0.41% (35th)	—	no fix	2026-01-22	—
CVE-2025-55316US	—	0.37% (30th)	—	no fix	2025-09-09	—
CVE-2025-49692US	—	0.35% (28th)	—	no fix	2025-09-09	—
CVE-2026-62874US	critical9.8OT elevated	0.33% (25th)	—	no fix	2026-09-18	—
CVE-2026-65673US	—	0.32% (25th)	—	no fix	2026-08-11	—
CVE-2026-83946US	medium6.1	0.32% (25th)	—	no fix	2026-09-18	—
CVE-2026-42901US	—	0.30% (23rd)	—	no fix	2026-05-22	—
CVE-2026-63522US	—	0.30% (22nd)	—	no fix	2026-08-11	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-284Improper Access Control6 CVEs
CWE-862Missing Authorization4 CVEs
CWE-918Server-Side Request Forgery (SSRF)4 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-285Improper Authorization3 CVEs
CWE-306Missing Authentication for Critical Function3 CVEs
CWE-639Authorization Bypass Through User-Controlled Key3 CVEs
CWE-345Insufficient Verification of Data Authenticity2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)46 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan