CVE-2026-33843Critical
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Assessment
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
- Severity
- Critical
- CVSS base score
- 9.1CVSS:3.1/
AV:N/ AC:L/ PR:N/ UI:N/ S:U/ C:H/ I:H/ A:N - Impact
- Elevation of Privilege
- EPSS, next 30 days
- 0.9%Higher than 57.1% of scored CVEs · FIRST model run 29 Sep 2026 · about EPSS
- Public exploit code
- No Nuclei template lists it
- Exploitability
- Not assessed
- Publicly disclosed
- No
- Customer action
- Not required (service-side fix)
- Component
- Microsoft Azure Active Directory B2C
- Weakness
- CWE-288: Authentication Bypass Using an Alternate Path or Channel
- Issued by
- Microsoft
- Published
- 21 May 2026 · May 2026
- Last revised
- 21 May 2026
Updates that fix it
0 KBsNo KB listed
MSRC lists no downloadable update, which usually means a service-side fix or a release-notes update. Check the MSRC advisory.