{"id":"CVE-2026-114162","kind":"vulnerability","aliases":["CVE-2026-114162"],"related":[],"title":"Microsoft Graph: incorrect authorization lets an attacker gain higher privileges","description":"Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.","summary":"Microsoft Graph has an incorrect authorization flaw that lets an attacker who already holds high privileges elevate privileges over the network (CVSS 3.1 9.1, privileges required: high, scope changed). The NVD record, scored by Microsoft, is the only source read. It says nothing about exploitation, a fix or customer action.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure","cloud-service","microsoft-365","microsoft-graph","vendor"],"not_affected_if":[],"how_to_check":"unknown: no Microsoft guidance read yet. Open the MSRC Security Update Guide entry for CVE-2026-114162 and look for the affected component and any customer action.","fix":null,"status":"open","published_at":"2026-11-10T19:19:09+00:00","first_seen_at":"2026-11-10T19:24:44+00:00","triaged_at":"2026-11-10T19:25:48+00:00","updated_at":"2026-11-10T19:33:22+00:00","category":"vendor","confidence":0.35,"triage":{"at":"2026-11-10T19:25:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Graph: incorrect authorization lets an attacker gain higher privileges","impact":"high","summary":"Microsoft Graph has an incorrect authorization flaw that lets an already-authorized attacker elevate their privileges over the network. The sources give a CVSS score of 9.1 and say nothing about exploitation in the wild.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["microsoft-graph","microsoft-365","azure"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains elevated privileges over the network on Graph","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-114162 for affected endpoints, fixed status and any customer action.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that use Microsoft Graph and Microsoft cloud services are the ones exposed, since the flaw is in the hosted service and the sources name no customer-side setting. The sources do not say which Graph endpoints or tenant configurations are affected. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000678,"input_tokens":4489,"output_tokens":458,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-114162 for affected endpoints, fixed status and any customer action.","search":"'-114162':13A,16A '-2026':12A,15A '-365':22B '3.1':49B '9.1':50B 'action':76B 'allow':82C 'alreadi':39B 'attack':7A,37B,85C 'author':4A,32B,78C,84C 'azur':17B 'chang':55B 'cloud':19B 'cloud-servic':18B 'custom':75B 'cve':11A,14A 'cvss':48B 'elev':43B,87C 'exploit':71B 'fix':73B 'flaw':33B 'gain':8A 'graph':2A,25B,28B,81C 'high':41B,53B 'higher':9A 'hold':40B 'incorrect':3A,31B,77C 'let':5A,35B 'microsoft':1A,21B,24B,27B,61B,80C 'microsoft-graph':23B 'network':47B,91C 'noth':69B 'nvd':57B 'privileg':10A,42B,44B,51B,88C 'read':66B 'record':58B 'requir':52B 'say':68B 'scope':54B 'score':59B 'servic':20B 'sourc':65B 'vendor':26B","nicknames":[],"mitigations":[],"who_affected":"Organizations that use Microsoft Graph and Microsoft cloud services are the ones exposed, since the flaw is in the hosted service and the sources name no customer-side setting. The sources do not say which Graph endpoints or tenant configurations are affected. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azure","cloudservice","critical","microsoft365","microsoftgraph","vendor"],"campaign_type":null,"search_a":"'-114162':13A,16A '-2026':12A,15A 'attack':7A 'author':4A 'cve':11A,14A 'gain':8A 'graph':2A 'higher':9A 'incorrect':3A 'let':5A 'microsoft':1A 'privileg':10A","search_b":"'-365':22B '3.1':49B '9.1':50B 'action':76B 'alreadi':39B 'attack':37B 'author':32B 'azur':17B 'chang':55B 'cloud':19B 'cloud-servic':18B 'custom':75B 'cvss':48B 'elev':43B 'exploit':71B 'fix':73B 'flaw':33B 'graph':25B,28B 'high':41B,53B 'hold':40B 'incorrect':31B 'let':35B 'microsoft':21B,24B,27B,61B 'microsoft-graph':23B 'network':47B 'noth':69B 'nvd':57B 'privileg':42B,44B,51B 'read':66B 'record':58B 'requir':52B 'say':68B 'scope':54B 'score':59B 'servic':20B 'sourc':65B 'vendor':26B","search_c":"'allow':82C 'attack':85C 'author':78C,84C 'elev':87C 'graph':81C 'incorrect':77C 'microsoft':80C 'network':91C 'privileg':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114162","severity":null,"published_at":"2026-11-10T19:19:09+00:00","modified_at":"2026-11-10T19:19:09+00:00","first_seen_at":"2026-11-10T19:24:44+00:00","fetched_at":"2026-11-10T19:24:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114162:2523","url":null,"severity":null,"published_at":"2026-11-10T19:33:22+00:00","modified_at":"2026-11-10T19:33:22+00:00","first_seen_at":"2026-11-10T19:33:22+00:00","fetched_at":"2026-11-10T19:33:22+00:00","note":"MSRC page is JS-only and web-cli returned nothing for MSRC, CVRF API and NVD; no primary text read. Only the NVD record (CVSS 3.1 9.1, AV:N/AC:L/PR:H/UI:N/S:C, scored by secure@microsoft.com) is known. Nothing verified. Revisit when the MSRC page can be read (try browser-cli) to confirm cloud-service status and any customer action."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}