What is the CVSS score of CVE-2025-59246?

CVE-2025-59246 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 7.7%.

Which versions of Microsoft Entra ID are affected by CVE-2025-59246?

Microsoft Entra ID, the identity provider for Microsoft cloud tenants, contains a critical authentication bypass (CVE-2025-59246) that allows unauthenticated attackers to access protected functions.

How to fix or mitigate CVE-2025-59246?

Since the vulnerable component is hosted and remediated by Microsoft, customers cannot apply a patch directly. Within 24 hours, confirm organizational use of Microsoft Entra ID and instruct security teams to monitor Microsoft's security advisory for CVE-2025-59246, while enabling enhanced logging for authentication anomalies. Within 7 days, review and tighten conditional access policies and enforce multi-factor authentication for all users as interim risk reduction, and continue monitoring for any signs of exploitation. Within 30 days, verify that Microsoft has released and applied the necessary remediation and conduct a review of identity security controls to ensure no residual risk remains.

Microsoft Entra ID CVE-2025-59246

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2025-10-09 secure@microsoft.com

Authentication Bypass Microsoft Entra Id

9.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

CWE-306 missing authentication on a network-facing identity service justifies AV:N/AC:L/PR:N/UI:N; privilege elevation yields full C:H/I:H/A:H within the tenant, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 13:57 vuln.today

CVE Published

Oct 09, 2025 - 21:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Azure Entra ID Elevation of Privilege Vulnerability

AnalysisAI

Authentication bypass in Microsoft Entra ID (CWE-306, missing authentication for a critical function) lets remote, unauthenticated attackers reach functionality that should require credentials, with maximum impact across confidentiality, integrity, and availability and a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N). Exploitation status is 'no public exploit identified at time of analysis' - the flaw is not listed in CISA KEV and no proof-of-concept was provided - but the EPSS score of 7.66% (94th percentile) marks it as substantially more likely to see exploitation attempts than the typical CVE. Multiple signals converge on genuine high priority, driven by the unauthenticated network vector, the critical-tier score, and the central role Entra ID plays as an identity provider for Microsoft cloud tenants; because Entra ID is a Microsoft-operated multi-tenant service, the vulnerable component is hosted and remediated by Microsoft rather than by customers on their own infrastructure.

Technical ContextAI

The CWE-306 classification means the root cause class is a critical function that is exposed without any authentication check, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the vulnerable path is reachable over the network, requires no privileges and no user interaction, and needs no special conditions described in the available data. Entra ID is Microsoft's cloud identity and access management platform: it brokers authentication for Microsoft 365 and Azure, issues OAuth/OIDC tokens, and supports federation protocols such as SAML and WS-Federation, so an authentication gap in this layer is inherently high-consequence because it can undermine trust decisions made by downstream applications that rely on Entra ID assertions. The CPE entry cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:* is version-wildcarded, which is consistent with a continuously updated SaaS platform rather than a discrete, installable product build; the provided data names no specific tenant configuration, feature toggle, protocol flow, or deployment mode as a precondition, so no concrete limiting condition can be confirmed. The single reference is Microsoft's MSRC update guide entry, which is the authoritative source for the affected-scope and any affected-configuration caveats.

RemediationAI

Vendor guidance is published through the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59246; the available data does not enumerate an exact patched build or version, and because Entra ID is a Microsoft-hosted service the vulnerable component is expected to be fixed centrally on the service side rather than through a customer-installed patch, so verify the exploitable window and any affected-configuration caveats directly against that advisory (patch status: patch available per vendor advisory, exact version not specified in the provided data). In the interim, tenant administrators should treat the exposure as an authentication-trust problem: review Entra ID sign-in and audit logs for anomalous token issuance, unexpected application or service-principal activity, and sign-ins that do not map to known users or conditional access outcomes; enforce and, where possible, tighten Conditional Access policies including strong MFA requirements; and restrict legacy or weak authentication protocols that bypass modern policy evaluation, accepting that blocking legacy authentication can break older clients and must be staged to avoid outages. Rotate credentials, secrets, and certificates, and review app registrations and consent grants for unauthorized changes, since an authentication bypass in an identity provider can invalidate assumptions made elsewhere in the environment.