Aug 2026: Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
CVE-2026-59115 Published on August 6, 2026
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
Weakness Type
Path Traversal: '.../...//'
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
Products Associated with CVE-2026-59115
Want to know whenever a new CVE is published for Microsoft Entra Provisioning Service? stack.watch will email you.
