[ CVE-2026-80092 · Published 16 Oct 2026 ]
Vulnerability in microsoft-identity-web
CVSS 5.3
EPSS <1%1 agency advisoryFix available
[ Description ]Official description
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
[ Fixes ]Fixes and patches
- Security bulletin: Microsoft CVE-2026-109461Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109461, cited by CERT-FR CERTFR-2026-AVI-1332
- Security bulletin: Microsoft CVE-2026-109468Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109468, cited by CERT-FR CERTFR-2026-AVI-1332
- Security bulletin: Microsoft CVE-2026-108452Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108452, cited by CERT-FR CERTFR-2026-AVI-1332
- Security bulletin: Microsoft CVE-2026-80092Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80092, cited by CERT-FR CERTFR-2026-AVI-1332
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1332
Multiple vulnerabilities in Microsoft products Translated from French
Multiple vulnerabilities have been discovered in Microsoft products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.