Another Critical Entra ID CVE — What NZ Tenants Should Actually Do

Microsoft has published another critical Entra ID vulnerability — CVE-2026-62916 — scored 9.1.

It is an authentication bypass using an alternate path or channel. In plain terms: under the right conditions, an unauthenticated attacker on the network could have elevated privileges without going through the normal sign-in checks. Microsoft classifies it as elevation of privilege (CWE-288).

The important operational fact: Microsoft has already fully mitigated it on the Entra service. There is no customer patch to apply, and no update wave to schedule. The CVE exists for transparency.

Why NZ organisations should still care

Entra ID is the front door for Microsoft 365, Azure, and most of the apps your people use. When identity has a problem, email, files, Teams, and line-of-business apps sit behind it.

A second high-severity Entra disclosure in a short window (after CVE-2026-69836 in August) is not a reason to panic. It is a reason to treat identity as a living control plane — not a set-and-forget directory.

For New Zealand organisations, that also sits next to Privacy Act 2020 expectations: if you hold personal information in a Microsoft tenant, you need to know how you would detect unusual sign-ins and privileged activity, and how you would respond.

What to do this week (even with no patch)

• Review Entra sign-in and audit logs around the disclosure window for anomalous authentication or privilege changes. Look for unexpected admin role assignments, unusual locations, and high-risk sign-ins you have not already investigated.
• Confirm break-glass and privileged access still look right. Two Global Admins plus a monitored emergency account is still the sensible pattern for most mid-market tenants.
• Push phishing-resistant MFA for admins where licensing allows (passkeys, FIDO2, Windows Hello for Business). SMS and voice are better than nothing; they are not enough for privileged roles.
• Re-check Conditional Access for legacy authentication blocks and policies that actually cover the accounts that matter — including guests and service accounts you forgot about.
• Treat Secure Score Identity actions as the backlog, not a dashboard vanity project. The same controls reduce blast radius for the next disclosure as well as for phishing and token theft.

What this is not

It is not a call to buy another security product. Most of the useful response lives in Entra, Conditional Access, Privileged Identity Management, and the logs you already have.

It is also not the same story as August’s CVSS 10.0 disclosure. Different CVE, same lesson: when Microsoft publishes an Entra advisory with “no customer action,” the useful customer action is still to verify your own identity posture.

If you want a practical starting list, see our Microsoft Secure Score Quick-Start Checklist, or the earlier note on what the August Entra disclosure taught us about identity posture.

Sources: MSRC CVE-2026-62916, CVE.org.