Azure Enterprise Services is affected by CVE-2026-83711, rated 10 (critical). No in-the-wild exploitation has been confirmed in the CISA KEV catalog at the time of writing.
What the flaw is
The NIST National Vulnerability Database describes it as follows:
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
At a glance
| Field | Detail |
|---|---|
| CVE | CVE-2026-83711 |
| Affected product | Azure Enterprise Services |
| Weakness | CWE-639 |
| CVSS | 10 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
What defenders should do
- Patch: apply the fixed release from Azure; check the vendor advisory linked below for the exact versions.
- Inventory: identify every instance of Azure Enterprise Services, prioritising internet-facing ones.
