# CVE-2026-85916: Microsoft Azure Active Directory information disclosure

Source: https://junglewise.ai/threats/cve-2026-85916-exposure-of-private-personal-information-to-an-unauthorized-actor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-85916 · Severity: medium · CVSS 6.2 · Published 2026-10-13

Azure Active Directory, which manages user identities and access for organizations, contains a flaw that allows unauthorized attackers to access private personal information. An attacker can exploit this to disclose sensitive user data without authentication, potentially compromising user privacy and enabling identity-based attacks.

Technologies: [Microsoft Azure Active Directory](https://junglewise.ai/threats/technologies/entra-id), [Microsoft Windows 11 23h2](https://junglewise.ai/threats/technologies/windows-11-23h2), [Microsoft Windows 11 24h2](https://junglewise.ai/threats/technologies/windows-11-24h2), [Microsoft Windows 11 25h2](https://junglewise.ai/threats/technologies/windows-11-25h2), [Microsoft Windows 11 26h1](https://junglewise.ai/threats/technologies/windows-11-26h1), [Microsoft Windows 11 26h2](https://junglewise.ai/threats/technologies/windows-11-26h2), [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-85916 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85916 being exploited in the wild.

**How severe is CVE-2026-85916?** Medium severity, with a CVSS score of 6.2, published 13 October 2026.

**Which products and versions are affected?** Microsoft Azure Active Directory.

**Is there a fix for CVE-2026-85916?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85916 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-85916?** Check whether you run Microsoft Azure Active Directory, Microsoft Windows 11 23h2, Microsoft Windows 11 24h2 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure flaw in Azure Active Directory that allows unauthorized access to private personal information. It can be exploited locally by an attacker without authentication, leading to exposure of sensitive user data stored in the identity management system.

## Affected products

- Microsoft Azure Active Directory

## Timeline

- 2026-10-13: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85916](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85916)

## Related threats

- [Windows DNS Server out-of-bounds read](https://junglewise.ai/threats/cve-2026-97844-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)
- [Windows DNS Server out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-97843-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)
- [Windows DNS Server out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-97842-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)
- [Windows DNS Server out-of-bounds read](https://junglewise.ai/threats/cve-2026-97841-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)
- [DNS Server out-of-bounds read information disclosure](https://junglewise.ai/threats/cve-2026-97840-out-of-bounds-read-in-dns-server-allows-an-authorized-attacker-to)