CVE-2026-62916: Critical Microsoft Entra ID Authentication Bypass (CVSS 9.1) — Detection and Remediation Guide

---
title: Entra ID Privileged Role Assignment by Anomalous Actor - CVE-2026-62916
id: 9f2c4a71-3b8d-4e6a-b1f5-7c9d2e4a6b80
status: experimental
description: Detects privileged directory role assignments where the initiating actor lacks a corresponding interactive sign-in, consistent with privilege elevation via an alternate authentication path (CWE-288) such as CVE-2026-62916.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62916
  - https://attack.mitre.org/techniques/T1078/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1078.004
logsource:
  product: azure
  service: auditlogs
detection:
  selection_operation:
    OperationName:
      - 'Add member to role'
      - 'Add eligible member to role'
      - 'Add scoped member to role'
  selection_role:
    TargetResources|contains:
      - 'Global Administrator'
      - 'Privileged Role Administrator'
      - 'Privileged Authentication Administrator'
      - 'Application Administrator'
      - 'Cloud Application Administrator'
      - 'Security Administrator'
  condition: selection_operation and selection_role
falsepositives:
  - Legitimate PIM-activated administrative changes (correlate with interactive sign-in and PIM audit events before closing)
level: high
---
title: Entra ID Service Principal Credential Addition - CVE-2026-62916
id: 4d7e1b53-8a2c-4f9d-a3e6-1b5c7d9e2f40
status: experimental
description: Detects addition of credentials (certificates or secrets) to service principals or app registrations, a common post-bypass persistence mechanism following Entra ID privilege elevation such as CVE-2026-62916.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62916
  - https://attack.mitre.org/techniques/T1098/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098.001
  - attack.t1550
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    OperationName:
      - 'Add service principal credentials'
      - 'Update application - Certificates and secrets management'
      - 'Add key credentials to application'
  condition: selection
falsepositives:
  - DevOps pipeline credential rotation (scope to known pipeline identities and change windows)
level: high
---
title: Entra ID Sign-In Missing Expected Authentication Context
id: 6b3a8d15-2f4e-4c7a-9d1b-5e8f0a3c6d21
status: experimental
description: Detects successful sign-ins where authentication requirement is satisfied without MFA claim on tenants enforcing MFA, potentially indicating authentication via an alternate path or channel such as CVE-2026-62916.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62916
  - https://attack.mitre.org/techniques/T1556/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.defense_evasion
  - attack.t1556
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: '0'
    AuthenticationRequirement: 'multiFactorAuthentication'
  filter_mfa_claim:
    AuthenticationDetails|contains: 'MFA'
  condition: selection and not filter_mfa_claim
falsepositives:
  - Legacy protocol clients and service accounts excluded from MFA policy (tune per-tenant exclusions)
level: medium

// Privileged role changes lacking a correlated interactive admin sign-in in the preceding hour
let Lookback = 7d;
let PrivilegedOps = AuditLogs
    | where TimeGenerated > ago(Lookback)
    | where OperationName in~ ("Add member to role", "Add eligible member to role", "Add service principal credentials", "Consent to application")
    | extend Actor = tostring(InitiatedBy.user.userPrincipalName),
             ActorIp = tostring(InitiatedBy.user.ipAddress),
             Role = tostring(TargetResources[0].displayName)
    | where isnotempty(Actor);
PrivilegedOps
| join kind=leftanti (
    SigninLogs
    | where TimeGenerated > ago(Lookback)
    | where ResultType == 0
    | where IsInteractive == true
    | project UserPrincipalName, SignInTime = TimeGenerated, IPAddress
) on $left.Actor == $right.UserPrincipalName
| project TimeGenerated, OperationName, Actor, ActorIp, Role, Result, CorrelationId
| sort by TimeGenerated desc;

// Token/session anomalies: successful auth satisfied with no MFA claim where policy requires it
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| where AuthenticationRequirement == "multiFactorAuthentication"
| mv-expand AuthDetail = AuthenticationDetails
| summarize AuthMethods = make_set(tostring(AuthDetail.authenticationMethod)) by UserPrincipalName, IPAddress, AppDisplayName, TimeGenerated, CorrelationId
| where AuthMethods !has "MFA" and AuthMethods !has "Previously satisfied"
| sort by TimeGenerated desc;

-- Hunt: processes holding connections to Entra ID token endpoints that are not standard auth clients
LET standard_auth_processes = '(?i)(msedge|chrome|firefox|Teams|OUTLOOK|EXCEL|WINWORD|explorer|Microsoft.AAD.BrokerPlugin|SearchHost|OneDrive)\\?\.exe$'

SELECT Pid, Name, Exe, Username,
       RemoteIP, RemotePort, Status
FROM netstat()
WHERE (RemoteIP =~ '.*' AND RemotePort = 443)
  AND Name !~ standard_auth_processes
  AND Status =~ 'ESTAB'
ORDER BY Pid

-- Hunt: MSAL/token broker cache artifacts modified outside user sign-in hours
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/Users/*/AppData/Local/Microsoft/IdentityCache/*')
ORDER BY Mtime DESC

# CVE-2026-62916 - Entra ID Post-Advisory Audit & Verification
# Requires: Microsoft.Graph PowerShell SDK (scopes: AuditLog.Read.All, Directory.Read.All, RoleManagement.Read.Directory)

Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All","RoleManagement.Read.Directory" -NoWelcome

$startDate = (Get-Date).AddDays(-14).ToString("yyyy-MM-ddTHH:mm:ssZ")

# 1. Export all directory role-management and credential events since disclosure
$auditEvents = Get-MgAuditLogDirectoryAudit -All `
  -Filter "activityDateTime ge $startDate" |
  Where-Object { $_.ActivityDisplayName -match 'role|credential|consent|service principal' }

$auditEvents | Select-Object ActivityDateTime, ActivityDisplayName, Result,
  @{N='Actor';E={$_.InitiatedBy.user.userPrincipalName}},
  @{N='ActorIp';E={$_.InitiatedBy.user.ipAddress}},
  @{N='Target';E={($_.TargetResources | ForEach-Object displayName) -join ';'}} |
  Export-Csv -Path ".\CVE-2026-62916_AuditExport.csv" -NoTypeInformation
Write-Host "[+] Exported $($auditEvents.Count) audit events to CVE-2026-62916_AuditExport.csv" -ForegroundColor Green

# 2. Inventory current privileged role membership - baseline against your last known-good export
Get-MgDirectoryRole | ForEach-Object {
  $role = $_
  Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id | ForEach-Object {
    [PSCustomObject]@{ RoleName = $role.DisplayName; MemberId = $_.Id; MemberType = $_.AdditionalProperties.'@odata.type' }
  }
} | Export-Csv -Path ".\PrivilegedRoleMembership_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "[+] Privileged role membership exported - diff against your last known-good baseline" -ForegroundColor Green

# 3. Flag service principals with recently added key/password credentials
Get-MgServicePrincipal -All | ForEach-Object {
  $sp = $_
  foreach ($cred in ($sp.KeyCredentials + $sp.PasswordCredentials)) {
    if ($cred.StartDateTime -gt (Get-Date).AddDays(-14)) {
      [PSCustomObject]@{ SPName = $sp.DisplayName; SPId = $sp.Id; CredType = $cred.GetType().Name; AddedOn = $cred.StartDateTime }
    }
  }
} | Format-Table -AutoSize

# 4. Verify tenant hardening: confirm Conditional Access policies are enabled
Get-MgIdentityConditionalAccessPolicy -All |
  Select-Object DisplayName, State, CreatedDateTime, ModifiedDateTime |
  Sort-Object State | Format-Table -AutoSize

Write-Host "`n[!] ACTION: Review Microsoft 365 admin center Service Health and the MSRC advisory for CVE-2026-62916 to confirm remediation is applied to your tenant." -ForegroundColor Yellow