CVE-2026-83711 and CVE-2026-70352: The CVSS 10.0 Baseline
On September 3, 2026, Microsoft disclosed nine vulnerabilities outside the standard Patch Tuesday cycle. Two of these carry a CVSS 10.0 rating: CVE-2026-83711, an authorization bypass in Azure AD B2C involving user-controlled keys, and CVE-2026-70352, a missing authentication flaw in Azure AI Language Authoring. These are not isolated incidents. They are server-side mitigations for flaws that existed in production identity infrastructure. The MSRC Update Guide provides the full technical breakdown of these disclosures.
Entra ID Authentication Bypasses
The Microsoft Entra ID stack remains a primary target. Two critical vulnerabilities, CVE-2026-83941 (9.9) and CVE-2026-62916 (9.1), represent distinct authentication and authorization bypasses. The latter, which utilized an alternate path for authentication, was subject to reports of pre-patch exploitation. These failures indicate that even highly managed enterprise services struggle with fundamental access control logic.
The Broader Vulnerability Batch
The September 3 disclosure includes additional high-severity flaws across the Microsoft ecosystem. Microsoft Copilot Studio is affected by CVE-2026-80098 (9.3), a failure in cryptographic signature verification. This pattern of improper validation extends to other services, including Fabric, Cosmos DB, Power Automate, and Discovery Studio. These vulnerabilities confirm that the security of enterprise services is frequently undermined by basic implementation errors in authentication and authorization protocols.
Structural Authentication Failures
Five of the nine vulnerabilities are categorized as CWE-639, CWE-306, CWE-862, or CWE-288. This concentration of authentication and authorization bypasses mirrors recent findings in the open-source ecosystem. Similar unauthenticated bypasses have been identified in R2R and Postgres MCP Pro. The recurrence of CWE-639—authorization bypass through user-controlled keys—across both enterprise and open-source environments suggests that authentication is often treated as an optional layer. With the Model Context Protocol (MCP) ecosystem now supporting over 97 million monthly SDK downloads and 10,000+ active public servers, as detailed in the Synvestable report, these structural flaws present a systemic risk to 28% of the Fortune 500.
Entra ID as a Systemic Chokepoint
Entra ID mediates access to Microsoft 365, Azure, GitHub Enterprise, and various SaaS and ZTNA solutions. It also manages workload and service-principal identities. Given that Microsoft reports over 600 million identity attacks daily, the presence of critical bypasses in this central hub creates a significant blast radius. As covered in the recent analysis of the authentication gap, reliance on centralized identity providers amplifies the danger of these structural flaws.
AI Services and Direct Exposure
The inclusion of Azure AI Language Authoring and Copilot Studio in this disclosure marks a shift in the attack surface. These are not traditional IT services; they are AI-specific infrastructure. The vulnerabilities allow for direct interaction with AI services, bypassing controls intended to secure model training and deployment. This aligns with the trend of AI services becoming primary targets for identity-based attacks.
Operational Implications
Microsoft mitigated these vulnerabilities server-side, requiring no direct action from customers. However, the existence of these flaws in production infrastructure remains the primary concern. Server-side mitigation is a reactive measure. Security teams must assume that identity infrastructure will contain latent vulnerabilities. Defense-in-depth strategies that do not rely exclusively on the integrity of the primary identity provider are necessary. Monitoring for anomalous authentication patterns and enforcing strict, granular authorization policies remains the only viable path for securing enterprise and AI-integrated stacks.