CVE-2026-65673: Microsoft Entra Connect Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges locally.
CSIRTS triage
- What
- An elevation of privilege vulnerability exists in Microsoft Entra Connect.
- Who is affected
- Systems running Microsoft Entra Connect are affected.
- Urgency
- Moderate urgency; CVSS 7.8 high severity and not yet exploited in the wild, but privilege escalation is a critical attack vector.
- Action
- Apply the latest security update for Microsoft Entra Connect from Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Entra Connect
Get an email when a new Entra Connect advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65673
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-656730.80% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 54% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-65673 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Microsoft Azure and Entra ID: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0287 [1.00] [M/H] Vulnerabilities fixed in Microsoft Azurencsc-nl
- unknownMultiple vulnerabilities in Microsoft products (August 12, 2026)cert-fr-avis
- highCVE-2026-65673: Improper neutralization of special elements used in an sql command ('sql injection') in Micros…nvd
Recent advisories for Microsoft Entra Connect
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
More from Microsoft Security Response Center
- highCVE-2026-70130: Microsoft Office Remote Code Execution Vulnerability2026-08-11
- highCVE-2026-70354: .NET Core Remote Code Execution Vulnerability2026-08-11
- highCVE-2026-68792: Microsoft Office Elevation of Privilege Vulnerability2026-08-11
- highCVE-2026-66807: Microsoft Office Graphics Component Remote Code Execution Vulnerability2026-08-11
- highCVE-2026-64909: Microsoft Office Remote Code Execution Vulnerability2026-08-11