{"id":"CVE-2026-109460","kind":"vulnerability","aliases":["CVE-2026-109460"],"related":[],"title":"Microsoft Entra Private Network Connector leaks sensitive information to local users","description":"Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally.","summary":"Microsoft Entra Private Network Connector exposes sensitive information to an unauthorized actor. An attacker with local authorized access can read data they should not see.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","microsoft-entra","private-network-connector"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:15+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","triaged_at":"2026-11-10T20:02:13+00:00","updated_at":"2026-11-10T20:02:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:02:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Entra Private Network Connector leaks sensitive information to local users","impact":"low","summary":"Microsoft Entra Private Network Connector exposes sensitive information to an unauthorized actor. An attacker with local authorized access can read data they should not see.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["microsoft-entra","private-network-connector"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker reads sensitive information the connector holds","analyst_note":"Check Microsoft's advisory for CVE-2026-109460 for affected versions, the fixed build and the exact data exposed.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations that run the Microsoft Entra Private Network Connector agent on their own machines or servers are the ones exposed. The sources do not say which versions are affected or which configurations make the flaw reachable.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000657,"input_tokens":4507,"output_tokens":412,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109460':14A,17A '-2026':13A,16A 'access':43B 'actor':37B,58C 'allow':65C 'attack':39B,68C 'author':42B,67C 'connector':5A,25B,30B,64C 'cve':12A,15A 'data':46B 'disclos':70C 'entra':2A,21B,27B,61C 'expos':31B 'exposur':51C 'inform':8A,33B,54C,71C 'infrastructur':18B 'leak':6A 'local':10A,41B,72C 'microsoft':1A,20B,26B,60C 'microsoft-entra':19B 'network':4A,24B,29B,63C 'privat':3A,23B,28B,62C 'private-network-connector':22B 'read':45B 'see':50B 'sensit':7A,32B,53C 'unauthor':36B,57C 'user':11A","nicknames":[],"mitigations":[],"who_affected":"Organizations that run the Microsoft Entra Private Network Connector agent on their own machines or servers are the ones exposed. The sources do not say which versions are affected or which configurations make the flaw reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","microsoftentra","privatenetworkconnector"],"campaign_type":null,"search_a":"'-109460':14A,17A '-2026':13A,16A 'connector':5A 'cve':12A,15A 'entra':2A 'inform':8A 'leak':6A 'local':10A 'microsoft':1A 'network':4A 'privat':3A 'sensit':7A 'user':11A","search_b":"'access':43B 'actor':37B 'attack':39B 'author':42B 'connector':25B,30B 'data':46B 'entra':21B,27B 'expos':31B 'inform':33B 'infrastructur':18B 'local':41B 'microsoft':20B,26B 'microsoft-entra':19B 'network':24B,29B 'privat':23B,28B 'private-network-connector':22B 'read':45B 'see':50B 'sensit':32B 'unauthor':36B","search_c":"'actor':58C 'allow':65C 'attack':68C 'author':67C 'connector':64C 'disclos':70C 'entra':61C 'exposur':51C 'inform':54C,71C 'local':72C 'microsoft':60C 'network':63C 'privat':62C 'sensit':53C 'unauthor':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109460","severity":null,"published_at":"2026-11-10T19:18:15+00:00","modified_at":"2026-11-10T19:18:15+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","fetched_at":"2026-11-10T19:24:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}