📋 ADVISORIES
- Microsoft to Make Passkeys Default in Entra ID, Retire SMS and Voice MFA
Microsoft will make passkeys the default authentication method in Entra ID.
- Microsoft Entra ID tenants with users enabled for SMS or voice MFA are affected.
- Passkeys become the default on September 1, 2026; Microsoft-provided SMS and voice MFA end on February 1, 2027.
- Eligible users will be automatically enabled for passkeys and prompted to register one during MFA sign-in.
- Passkeys use public-key cryptography and include synced and device-bound credentials.
- Users relying only on SMS or voice will face a blocking passkey-registration prompt after February 1, 2027. 📄 Source: learn.microsoft.com · 📎 Coverage: it-connect.tech · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
- CVE-2026-18438 — CVSS 8.8 — Templately through 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to R...