PT-2026-42841 · Microsoft · Azure Active Directory B2C

Alexander Tan · Published 2026-05-22 · Updated 2026-05-27 · CVE-2026-33843

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Azure Active Directory B2C (affected versions not specified)

Description An authentication bypass exists via an alternate path or channel, which allows an unauthorized attacker to elevate privileges over a network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-33843

Affected Products

Azure Active Directory B2C

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-33843 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33843 · Vendor Advisory
• https://twitter.com/DFIR_Lab/status/2059454260819968496 · Twitter Post
• https://twitter.com/NewsNerdie/status/2058247189399212078 · Twitter Post
• https://twitter.com/CVEnew/status/2058155762711740499 · Twitter Post
• https://t.me/CVEtracker/54690 · Telegram Post
• https://t.me/cveNotify/164877 · Telegram Post