What is the CVSS score of CVE-2025-59218?

CVE-2025-59218 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.7%.

Which versions of Microsoft Entra ID are affected by CVE-2025-59218?

A critical-severity elevation-of-privilege vulnerability in Microsoft Entra ID, the identity platform that governs sign-in and access for Microsoft 365, Azure, and the organization's federated…

How to fix or mitigate CVE-2025-59218?

Within 24 hours, confirm whether the organization's tenant was in scope for the Entra ID service-side correction referenced in the advisory and capture a snapshot of recent sign-in, audit, and consent-grant logs; immediately restrict user consent so that only verified publishers can grant access, or enable the admin consent workflow so all new OAuth grants require privileged review. Within 7 days, enforce phishing-resistant authentication (FIDO2 security keys or passkeys) and number matching for Authenticator push through Conditional Access, block legacy authentication protocols, require compliant or managed devices for access to Microsoft 365 and Azure management portals, and audit existing enterprise applications and service principals to identify and revoke stale or overly permissive consent grants and high-privilege app roles. Within 30 days, extend least-privilege governance by moving privileged directory roles behind just-in-time activation with approval and time limits, review app registration credential and permission sprawl, enable risk-based Conditional Access and Defender for Cloud Apps anomaly policies for suspicious consent activity, and embed consent-phishing and prompt-approval scenarios into the security awareness program and email filtering rules; continue monitoring Microsoft's Entra service health communications for any change to the fix status for CVE-2025-59218.

Microsoft Entra ID CVE-2025-59218

CRITICAL

Improper Access Control (CWE-284)

2025-10-09 secure@microsoft.com

Authentication Bypass Microsoft Entra Id

9.6

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

vuln.today AI

9.6 CRITICAL

Network-reachable cloud identity service (AV:N), no attacker auth but victim interaction needed (PR:N/UI:R); access-control flaw crosses a security boundary (S:C) with high confidentiality/integrity and limited availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 13:58 vuln.today

CVE Published

Oct 09, 2025 - 21:15 cve.org

CRITICAL 9.6

DescriptionCVE.org

Azure Entra ID Elevation of Privilege Vulnerability

AnalysisAI

Elevation of privilege in Microsoft Entra ID could enable an unauthenticated remote attacker to gain higher privileges, but exploitation requires victim user interaction (e.g., clicking a malicious link or approving a consent/authentication prompt). No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is 0.66% (percentile 50%). Microsoft has released a service-side fix for this cloud service, and the vulnerability is rated critical with a CVSS score of 9.6.

Technical ContextAI

Microsoft Entra ID is a cloud-based identity and access management service, and this vulnerability falls under CWE-284 (Improper Access Control). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) indicates a network-exploitable flaw requiring no pre-authentication (PR:N) but demanding user interaction (UI:R), with a scope change (S:C) that can impact resources beyond the initial security context-typical of authorization flaws in identity systems. The exact feature or configuration involved is not specified in the one-line MSRC advisory; verification against the advisory is needed to identify the precise triggering condition. The scope change and high confidentiality/integrity impact suggest an attacker could potentially access or modify other users' resources or escalate to administrative roles within the Entra ID tenant.

RemediationAI

Microsoft has likely deployed a service-side fix for this cloud service vulnerability; confirm status at the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59218). No customer-side patch version is applicable. As a compensating control, restrict user consent to verified publishers and require admin approval for consent requests-this reduces the attack surface for consent-based privilege escalation but may impact user flexibility. Additionally, enforce phishing-resistant multi-factor authentication and monitor Entra ID audit logs for anomalous role assignments or consent grants. These measures can help mitigate the risk while the service-side fix is being rolled out.