The National Vulnerability Database has published seven CRITICAL-severity, network-vector CVEs against Microsoft products in a single 3-day window. Two of them carry a perfect CVSS 10.0 score. If you run Microsoft 365, Teams, or Entra ID in production — and statistically, you do — your exposure window started the moment these entries went live, because every one of these flaws is exploitable over the network without physical access or local foothold.
The headline issues:
- CVE-2026-63508 (CVSS 10.0) — Missing authentication for a critical function in Microsoft Planetary Computer Pro, allowing an unauthorized remote attacker to elevate privileges.
- CVE-2026-65667 (CVSS 10.0) — Missing authorization in Microsoft Teams, allowing an unauthorized remote attacker to elevate privileges.
- CVE-2026-59115 (CVSS 9.9) — Path traversal (
.../...//) in Microsoft Entra Provisioning Service (SyncFabric), exploitable by an authorized attacker to escape intended directory scope. - CVE-2026-62873 (CVSS 9.8) — Improper verification of cryptographic signatures in the Microsoft 365 Admin Center, allowing unauthorized attackers to bypass signature validation.
- CVE-2026-62896, CVE-2026-70332, CVE-2026-59118 — additional critical network-vector entries published in the same batch; consult the NVD entries for full vector strings as they are populated.
This is a vulnerability-management emergency, but it's also an identity-security emergency: four of these seven flaws live in the identity and collaboration plane (Teams, Entra provisioning, M365 Admin Center). That is precisely the plane attackers target when they want tenant-wide persistence.
Technical Analysis
What's actually vulnerable
A critical point many write-ups will miss: most of these CVEs affect Microsoft's hosted service plane, not on-premises binaries you patch yourself. Planetary Computer Pro, Teams service-side components, Entra Provisioning Service (SyncFabric), and M365 Admin Center are cloud-delivered. For service-side CVEs, Microsoft deploys fixes to the hosted infrastructure — your job is not to run Windows Update, it's to:
- Confirm whether remediation is fully Microsoft-side or requires a customer action (check each advisory's "Customer Action Required" field in the Microsoft Security Response Center update guide).
- Hunt for exploitation that may have occurred before the service-side fix landed.
- Harden tenant configuration so that a successful privilege escalation has minimal blast radius.
Attack mechanics, from a defender's seat
CVE-2026-63508 — Planetary Computer Pro (CWE-306, Missing Authentication for Critical Function). A privileged API endpoint is reachable without any authentication. An attacker who can reach the service over the network can invoke administrative functionality directly — no credentials, no token, no prior foothold. If your organization uses Planetary Computer Pro for geospatial data workloads, treat any unauthenticated request hitting administrative routes in your access logs as a potential compromise event.
CVE-2026-65667 — Teams (CWE-862, Missing Authorization). The service fails to check whether the caller is authorized for the requested operation. An unauthorized remote attacker can escalate privileges — in practice this class of bug in Teams typically means acting in contexts (tenant, team, or user scope) the attacker has no business touching. Post-exploitation behavior to hunt for: unexpected membership changes, anomalous app installations into Teams, and privilege-bearing role assignments following Teams-originated activity.
CVE-2026-59115 — Entra Provisioning Service / SyncFabric (Path Traversal). The .../...// sequence is a classic filter-evasion traversal: naive canonicalization strips ../ but leaves the doubled-slash variant resolving outside the intended directory. In a provisioning service, directory escape means reading or writing objects outside the authorized provisioning scope — potentially touching identity objects, service principal configurations, or sync job definitions belonging to other scopes. An authorized attacker (low-privilege authenticated context) is required, which makes this a privilege-escalation primitive inside your tenant.
CVE-2026-62873 — M365 Admin Center (Improper Cryptographic Signature Verification, CWE-347). When signature validation is broken, forged tokens, assertions, or signed requests can be accepted as legitimate. In the Admin Center context, that's a direct path to administrative plane access with attacker-controlled identity material.
Exploitation status
At time of writing, these are freshly published NVD entries (within 3 days). There is no confirmed public exploit code or CISA KEV listing for these identifiers yet — but CVSS 10 unauthenticated network bugs do not stay theoretical for long. Historically, weaponization of critical Microsoft identity-plane flaws moves from disclosure to active probing in days, not weeks. Operate on the assumption that scanning for the unauthenticated endpoints (63508, 65667) begins immediately if it hasn't already.
Detection & Response
Because these are cloud-plane vulnerabilities, your telemetry lives in Entra ID audit logs, M365 unified audit log, and (if you ingest them) service access logs — not in Sysmon. The detections below are tuned to the post-exploitation behaviors each CVE enables: unauthorized privilege grants, provisioning-scope anomalies, and suspicious admin-plane activity.
Sigma
---
title: Suspicious Privileged Role Assignment Following Teams or Admin Center Activity
id: 8c2e4b61-3f7a-4d29-9e14-6a1b5c8d2f40
status: experimental
description: Detects privileged directory role assignments in Entra ID that may follow exploitation of missing-authorization or signature-verification flaws in Microsoft cloud services (CVE-2026-65667, CVE-2026-62873).
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-65667
- https://nvd.nist.gov/vuln/detail/CVE-2026-62873
author: Security Arsenal
date: 2026/04/06
tags:
- attack.privilege_escalation
- attack.persistence
- attack.t1078
logsource:
product: azure
category: auditlogs
detection:
selection:
operationName:
- 'Add member to role'
- 'Add eligible member to role'
- 'Add app role assignment to service principal'
targetResources|contains:
- 'Global Administrator'
- 'Privileged Role Administrator'
- 'Cloud Application Administrator'
- 'Application Administrator'
falsepositives:
- Legitimate administrative role changes during onboarding or incident response — correlate with change tickets
level: high
---
title: Entra Provisioning Service Scope or Configuration Modification
id: 2d9f7c35-8b1e-4a60-b523-9f4e6d0a1c37
status: experimental
description: Detects modifications to Entra provisioning (SyncFabric) job configuration or scope that may indicate path-traversal-based scope escape via CVE-2026-59115.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-59115
author: Security Arsenal
date: 2026/04/06
tags:
- attack.privilege_escalation
- attack.defense_evasion
- attack.t1078
logsource:
product: azure
category: auditlogs
detection:
selection:
operationName|contains:
- 'provisioning'
- 'synchronization'
operationName|contains:
- 'Update'
- 'Delete'
- 'Pause'
- 'Restart'
falsepositives:
- IdP provisioning lifecycle management by identity engineering teams
level: medium
KQL (Microsoft Sentinel)
Hunt for the privilege-escalation blast radius: privileged role grants, anomalous admin-portal activity, and provisioning changes clustered in the exposure window. Tune ExposureStart to when the CVEs were first published.
let ExposureStart = ago(7d);
let PrivRoles = dynamic(["Global Administrator", "Privileged Role Administrator", "Application Administrator", "Cloud Application Administrator"]);
union isfuzzy=true
(AuditLogs
| where TimeGenerated >= ExposureStart
| where OperationName has_any ("Add member to role", "Add eligible member to role", "Add app role assignment")
| extend Target = tostring(TargetResources[0].displayName), Actor = tostring(InitiatedBy.user.userPrincipalName)
| where Target has_any (PrivRoles)
| project TimeGenerated, OperationName, Actor, Target, SourceSystem = "AuditLogs"),
(AuditLogs
| where TimeGenerated >= ExposureStart
| where OperationName has_any ("provisioning", "synchronization")
| where OperationName has_any ("Update", "Delete", "Pause")
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| project TimeGenerated, OperationName, Actor, Target = tostring(TargetResources[0].displayName), SourceSystem = "AuditLogs"),
(OfficeActivity
| where TimeGenerated >= ExposureStart
| where OfficeWorkload == "MicrosoftTeams"
| where Operation in ("MemberAdded", "TeamsAppInstalled", "BotAdded", "TabAdded", "RoleAssignmentChanged")
| project TimeGenerated, OperationName = Operation, Actor = UserId, Target = tostring(Members), SourceSystem = "OfficeActivity")
| summarize EventCount = count(), Operations = make_set(OperationName) by Actor, bin(TimeGenerated, 1h)
| where EventCount >= 3
| sort by TimeGenerated desc
The 3-events-per-hour-per-actor threshold is a starting point; drop it to 1 for Global Administrator grants in mature tenants where such changes are rare and always ticketed.
Velociraptor VQL
If exploitation pivoted from the cloud plane to an endpoint (stolen admin session, token replay from an admin workstation), hunt the endpoints your M365/Entra administrators actually use for evidence of anomalous browser token theft or suspicious processes touching Teams and browser credential stores.
-- Hunt admin workstations for processes accessing browser/Teams credential artifacts
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
CommandLine =~ '(?i)(Cookies|Login Data|Local State|Web Data)'
AND CommandLine =~ '(?i)(Chrome|Edge|msedge|Teams|ms-teams)'
)
OR (
Name =~ '(?i)(rundll32|regsvr32|powershell|pwsh|wscript|cscript)\.exe'
AND CommandLine =~ '(?i)(teams|token|cookie|dpapi|vault)'
)
Tenant Verification and Hardening Script
Run this from an authenticated Graph PowerShell session to snapshot your current privileged-role assignments and risky app consent grants, so you can diff against a known-good baseline and catch unauthorized escalation after the fact.
# Requires: Microsoft.Graph PowerShell SDK, run as a user with Directory.Read.All + RoleManagement.Read.All
Connect-MgGraph -Scopes "Directory.Read.All","RoleManagement.Read.Directory","Application.Read.All","AuditLog.Read.All"
# Export all active privileged role assignments for baseline diffing
$roles = Get-MgRoleManagementDirectoryRoleDefinition -All | Where-Object { $_.DisplayName -in @("Global Administrator","Privileged Role Administrator","Application Administrator","Cloud Application Administrator") }
foreach ($role in $roles) {
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'" -All |
Select-Object @{n='Role';e={$role.DisplayName}}, PrincipalId, Id |
Export-Csv -Path ".\PrivRoleBaseline_$($role.DisplayName -replace ' ','_').csv" -NoTypeInformation
}
# Flag service principals with high-value app-only Graph permissions (app consent abuse surface)
Get-MgServicePrincipal -All | ForEach-Object {
$sp = $_
Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -All |
Where-Object { $_.AppRoleId -ne '00000000-0000-0000-0000-000000000000' } |
Select-Object @{n='SPDisplayName';e={$sp.DisplayName}}, ResourceDisplayName, AppRoleId, CreatedDateTime
} | Export-Csv -Path ".\AppRoleAssignments.csv" -NoTypeInformation
# Pull last 7 days of role-related and provisioning audit events for review
$start = (Get-Date).AddDays(-7).ToString('yyyy-MM-ddTHH:mm:ssZ')
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $start" -All |
Where-Object { $_.ActivityDisplayName -match 'role|provisioning|synchronization' } |
Select-Object ActivityDateTime, ActivityDisplayName, @{n='Actor';e={$_.InitiatedBy.user.userPrincipalName}}, Result |
Export-Csv -Path ".\RoleProvAudit_7d.csv" -NoTypeInformation
Write-Host "Baseline export complete. Diff PrivRoleBaseline_*.csv and AppRoleAssignments.csv against last known-good snapshot."
Remediation
- Check MSRC first, per CVE. For each identifier, pull the Microsoft Security Response Center entry (linked from each NVD page: CVE-2026-63508) and read the "Customer Action Required" line. Cloud-service CVEs are typically remediated Microsoft-side with no customer patch, but if a client-side component (Teams desktop client, admin SDK, provisioning agent) is implicated, the advisory will name the fixed build — deploy it through your normal ring with emergency priority.
- Planetary Computer Pro users (CVE-2026-63508): If you operate a self-managed deployment or expose any administrative endpoint, restrict network access to management routes immediately via NSG/firewall allow-listing until Microsoft confirms the fix is deployed. Unauthenticated critical functions should never be internet-reachable regardless of patch state.
- Assume pre-patch exposure and hunt retroactively. Service-side fixes close the door going forward; they do not evict an attacker who escalated privileges last week. Run the KQL and Graph baseline exports above, and diff privileged role membership against your last known-good state (you do snapshot role membership, right?).
- Reduce blast radius now:
- Enforce phishing-resistant MFA (FIDO2/passkeys) on all privileged roles via Conditional Access — signature/token forgery paths matter less when token replay can't satisfy your CA policies.
- Move eligible privileged roles to PIM just-in-time activation so a forged or escalated session finds no standing admin access.
- Review Teams app permission policies; restrict third-party app and bot installation to admin-approved lists.
- Audit Entra provisioning (SyncFabric) configurations for scope changes you didn't make.
- Alert fatigue guardrail: don't deploy the Sigma rules tenant-wide without a change-ticket correlation source. Role assignments are legitimate daily activity in large tenants; wire them to your ITSM context or scope them to Privileged Role Administrator / Global Administrator targets only.
If CISA adds any of these to the Known Exploited Vulnerabilities catalog, the KEV remediation deadline applies to federal agencies — but treat it as your own deadline regardless of sector.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.