Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

Date Aug 6, 2026

Type Patch Tuesday

Signal Critical vendor advisory

Vendor / Product Microsoft · Microsoft Entra Provisioning Service (SyncFabric)

CVE CVE-2026-59115

Critical vendor advisory CVE-2026-59115

Summary

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Why it matters

Microsoft published this item through its Security Update Guide, making it part of Patch Tuesday triage for affected Windows, cloud, or application estates. EPSS percentile: 47%.

Operator check

Review the Microsoft Security Update Guide entry for CVE-2026-59115. Confirm whether Microsoft Entra Provisioning Service (SyncFabric) is deployed, then apply the current security update or documented mitigation. CVSS score: 9.9. EPSS probability: 0.6%; percentile: 47%.

Sources

MSRC 2026-Aug Security Update Guide NVD — CVE-2026-59115

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed