Quick Look: CVE-2026-114162, Incorrect Authorization in Microsoft Graph (Azure PIM) Enabling Global Administrator Escalation

Introduction

Under CVE-2026-114162, an application holding a Microsoft Graph permission intended for removing directory roles could instead assign them, up to and including Global Administrator in the affected tenant. Microsoft Graph is the API layer for identity, access, and security operations across Microsoft Entra and Microsoft 365, so an authorization mistake on a role management path translates directly into control over the tenant's directory.

Microsoft published the advisory on November 10, 2026. NVD lists a CVSS v3.1 base score of 9.1 (Critical), while Microsoft's own severity label is Important. Both classifications are worth preserving when communicating risk internally. At publication, Microsoft reported no exploitation and no prior public disclosure.

Technical information

Root cause

The weakness is CWE-863, Incorrect Authorization, which MITRE defines as a product performing an authorization check incorrectly when an actor attempts to access a resource or perform an action. The advisory is titled Microsoft Graph Elevation of Privilege Vulnerability, but the fixed product is Azure Privileged Identity Management (PIM). Graph is the API surface that exposes PIM's role management operations, which explains the naming.

Microsoft's FAQ describes the core problem: an application holding the affected role removal permission could send a crafted request that assigns privileged directory roles. A permission meant to authorize one action (removing roles) also authorized a far more consequential one (granting them). The authorization boundary that failed sits between the application's existing permission and the privileged role assignment the request achieves.

Microsoft has not named the affected permission, and the advisory does not provide the request endpoint, HTTP method, payload, or a reproducible sequence. We therefore cannot describe the exploit at the request level, and no vulnerable code has been published.

Attack flow (as documented by Microsoft)

1. The attacker controls an application that holds the affected role removal permission in the target tenant. This is a substantial prerequisite, reflected in the PR:H metric. An arbitrary signed-in user cannot run this attack.
2. The attacker sends a specially crafted request over the network to the affected role management functionality.
3. The authorization check fails to restrict the request to the removal capability the permission was meant to grant, and a privileged directory role assignment is created.
4. Successful exploitation can grant Global Administrator privileges in the affected tenant. No interaction from another user is required.

This is the exploitation scenario Microsoft documents. It does not describe an observed campaign.

CVSS interpretation

The published base vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Low attack complexity does not mean low privileges are sufficient. Changed scope does not establish compromise of other tenants either, since the outcome Microsoft states explicitly concerns the affected tenant. An attacker needs substantial application privileges up front, and the result is a much more powerful role. The two facts do not contradict each other.

Exploitation status at publication

Microsoft credits Idan Masas of Masas Technologies, LLC, and shoodagiri for the report. Those credits acknowledge researchers and attribute no attack to anyone. The Unproven exploit maturity metric sits alongside a Confirmed report confidence metric, meaning the issue was verified even though no public exploit exists. CVE.now also notes that attacks may be reported before a vulnerability appears in CISA's catalog, so these findings describe the public picture at release and do not show an absence of risk.

Patch information

Microsoft fixed CVE-2026-114162 through its own update channel on November 10, 2026, as part of the November 2026 security release. The fix ships as a new service build rather than a source code patch. Microsoft has published no diff, commit, or downloadable package, so this section relies on Microsoft's machine-readable advisory data (CSAF and the Security Update Guide API) and the matching NVD record.

What was fixed and where

Microsoft's CSAF product tree shows two states:

The CSAF remediation entry is a vendor_fix dated 2026-11-10T08:00:00Z with the details string 2.0.32.2053:Security Update. The Security Update Guide API agrees. It reports productStatus: "fixed", a KB entry of type Release Notes / Security Update with fixedBuildNumber: "2.0.32.2053", and an empty affectedBinaries list. That last detail fits a server-side component, since there are no binaries on customer machines to replace. The record is revision 1 (Information published), dated the same day as the fix.

What the fix most likely changes

Microsoft has not described the code change. Based on the CWE classification and the FAQ, build 2.0.32.2053 presumably adds a proper permission check to the role assignment path, so that holding only the role removal permission is no longer enough to create privileged role assignments. Treat this as an inference from the advisory. It is not a confirmed description of the code.

How Microsoft scores the fix

Microsoft's temporal metrics mark the fix as official and the issue as confirmed, lowering the 9.1 base score to a 7.9 temporal score:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

The temporal score does not change the base severity and does not by itself confirm that a particular tenant is running the corrected build.

Customer action required

This is a cloud service, but Microsoft does not describe the fix as fully automatic. Both the CSAF notes and the API set customerActionRequired: true, and the advisory states that the vulnerability requires customer action to resolve. These sources do not say what that action is. Some other Microsoft cloud advisories state that no action is needed when a fix is purely server side, so this flag stands out. We recommend checking the HTML advisory and the PIM release notes for whatever tenant-side step accompanies build 2.0.32.2053. No CVE-specific workaround is documented.

Hardening alongside the fix

Microsoft's general Graph guidance is to request the fewest and least privileged permissions an application needs, distinguishing delegated access (acting for a signed-in user) from application access (acting under the app's own identity). Its example is an app that only reads the signed-in user's profile, which needs User.Read, not User.ReadWrite. Given the documented prerequisite, it is reasonable to review which applications hold role management permissions and whether they need them. This is general hardening. It has not been shown to substitute for the fix, and the profile permission example does not identify the permission affected here.

Affected systems and versions

• Exposure condition: a tenant in which an attacker controls an application holding the affected role removal permission.
• Component type: server-side service. The API lists no affected customer binaries.
• Scope caveat: the CVE record leaves its default product status as unknown. Do not extend the affected interval into an assertion that every Microsoft Graph component or other product is affected.

Vendor security history

The Cyber Safety Review Board's review of the 2023 Exchange Online intrusion offers independent context on Microsoft cloud identity failures. In that incident, an actor used forged tokens signed with a stolen consumer signing key, and a token validation flaw allowed access to enterprise email accounts even though the key should have been limited to consumer systems. The Board concluded the intrusion was preventable and that Microsoft's security culture was inadequate and required an overhaul. That incident involved a different trust boundary failure and is not evidence that the same actor exploited CVE-2026-114162.

Microsoft's July 2026 Secure Future Initiative progress report describes secure-by-default tenant creation with drift detection operating at scale. That is vendor-reported progress and does not independently confirm this CVE's remediation.

For scale, an October 30, 2026 report citing Synergy Research places Microsoft second among major cloud providers with 19 percent of the Q3 2026 cloud infrastructure services market. The figure measures infrastructure market share. It says nothing about Graph adoption or the number of tenants exposed.

References

• NVD entry for CVE-2026-114162
• CVE Record: CVE-2026-114162
• Microsoft Security Update Guide: CVE-2026-114162
• Microsoft CSAF advisory for CVE-2026-114162
• Microsoft Security Update Guide API, affected product data
• CVE.now: CVE-2026-114162
• StackFlag: CVE-2026-114162 in Azure Privileged Identity Management
• MITRE CWE 863: Incorrect Authorization
• Microsoft Learn: Best practices for using Microsoft Graph permissions
• Microsoft Learn: Overview of permissions and consent in the Microsoft identity platform
• Microsoft Learn: Microsoft Graph overview
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Secure Future Initiative Progress Report, July 2026
• DCD: Synergy reports enterprise cloud infrastructure spending jumped 55% YoY in Q3
• Synergy Research Group: Cloud Market Share Trends
• CISA Known Exploited Vulnerabilities Catalog