Will Microsoft Entra ID max-severity flaw be added to CISA KEV by Sept 2026?

Microsoft patched a maximum-severity vulnerability in Entra ID identity and access management platform that was already being exploited in attacks (Bleeping Computer). This IAM vulnerability poses broad enterprise risk. Market tracks whether CISA formally catalogs this as a known-exploited vulnerability.

Resolution Criteria

CISA KEV Catalog will be checked by Sept 30, 2026 for Entra ID flaw entry. YES if the vulnerability (CVE TBD) appears with evidence of active exploitation. NO if not added or if exploitation claims are not publicly confirmed by CISA/Microsoft.