Microsoft Graph: Elevation of privilege due to incorrect authorization

Summary

Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over the network. According to the CNA record, the affected component is Azure Privileged Identity Management (PIM) in the version range 1.0.0 to before 2.0.32.2053. The CVSS vector requires high privileges (PR:H), so the attacker must already hold a privileged or consented account. Successful exploitation could affect confidentiality, integrity and availability with a scope change. The details are not yet confirmed on the MSRC advisory page.

Affected

• Microsoft Azure Privileged Identity Management (PIM) 1.0.0 to before 2.0.32.2053 (per CNA record)
• Other Microsoft Graph components: Unknown.

Fixed in

• Version 2.0.32.2053 or later, as implied by the affected range in the CNA record. Not confirmed on the MSRC page.

Workaround

• No official mitigation known.
• Review delegated and application Graph permissions and remove any that are broader than needed.
• Review app consents and assigned roles across user accounts and the tenant.
• Enable Graph activity logs via Azure Monitor diagnostic settings.

Exploitation

• Unknown. No evidence of exploitation in the wild or public proof of concept found at the time of research.
• NVD status was Awaiting Analysis.

Our recommendation

• Check the MSRC advisory page for the official affected products, fixed versions and customer actions.
• Verify the number of privileged administrators, MFA and Conditional Access on admin roles.
• Review third-party app consents and remove unused ones.
• Enable and monitor Graph activity logs.
• Re-check NVD and CISA KEV in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-114162 msrc.microsoft.com
• Palo Alto Networks: Detecting threats with Microsoft Graph activity logs www.paloaltonetworks.com
• Microsoft Learn: Microsoft Graph permissions reference learn.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:23.