GCVE-110-NCSC-2026-142

Advisory PublishedCVSS 9.3/10

Vulnetix · Advisory published May 12, 2026

Exposure of sensitive information in Azure Entra ID can allow unauthorized attackers to conduct network spoofing attacks, potentially compromising network integrity and security.

Download JSON Open in Console

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-73External Control of File Name or PathCWE-347Improper Verification of Cryptographic SignatureCWE-303Incorrect Implementation of Authentication AlgorithmCWE-426Untrusted Search PathCWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')CWE-918Server-Side Request Forgery (SSRF)

Risk Scores

CVSS 3.1

9.3/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

Affected Products

Vendor	Product	Versions	Platforms
Microsoft	vers:unknown/*	—	—

Aliases

CVE-2026-32204 CVE-2026-32207 CVE-2026-33109 CVE-2026-33117 CVE-2026-33833 CVE-2026-33844 CVE-2026-34327 CVE-2026-35428 CVE-2026-35435 CVE-2026-40379 CVE-2026-40381 CVE-2026-41086 CVE-2026-41103 CVE-2026-41105 CVE-2026-42823 CVE-2026-42830

References

advisory

Browse GCVE Records

73,685 records in the GCVE database · Updated July 18, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON