High severity7.8NVD Advisory· Published Aug 11, 2026· Updated Aug 17, 2026
CVE-2026-65673
CVE-2026-65673
Description
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges locally.
Affected products
2Patches
Vulnerability mechanics
References
1- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65673nvdVendor Advisory
News mentions
2- Patch Tuesday - August 2026Rapid7 Blog · Aug 11, 2026
- Microsoft Patch Tuesday Update August 2026 – 394 Vulnerabilities Fixed, Including 3 Zero-DaysCyber Security News · Aug 11, 2026