Information disclosure in Microsoft Entra Private Network Connector - CVE-2026-109460
Published: November 10, 2026
Vulnerability identifier: #VU164732
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109460
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information, including credentials.
The vulnerability exists due to exposure of sensitive information to unauthorized actors in Microsoft Entra Private Network Connector when information is accessed locally. A local user can exploit this exposure to obtain credentials.
Affected software
Microsoft Entra Private Network Connector
How to mitigate CVE-2026-109460
Install security update from vendor's website.
Microsoft Entra Private Network Connector - update to 1.5.5130.0