Microsoft Entra ID CVE-2026-23663

No special conditions - remote unauthenticated exploitation against default configurations of Microsoft Entra ID tenants that have Microsoft Global Secure Access (GSA) enabled. The CVSS vector confirms network reachability, low attack complexity, no privileges, and no user interaction. The primary limiting factor is that the affected component is GSA, so tenants that have never onboarded to Microsoft's Security Service Edge offering are unlikely to be in scope; tenants actively using GSA traffic forwarding profiles for Private Access or Internet Access are the relevant exposure surface. Additionally, because Entra ID is a Microsoft-operated cloud service, the exposure window is bounded by Microsoft's server-side rollout of the fix rather than by customer patching cadence.

The CVSS vector AV:N/AC:L/PR:N/UI:N is severe on paper - network-reachable, low complexity, no authentication, no user interaction - and the C:H impact on a tenant-wide identity service like Entra ID is consequential. However, several signals temper this: the vector specifies S:U (no scope change), I:N and A:N (no integrity or availability impact, only confidentiality), and E:U (exploit code maturity is Unproven), with RL:O (official fix available) and RC:C (confirmed). No EPSS score, KEV listing, or public POC was provided, suggesting this was a coordinated Microsoft-internal disclosure rather than an in-the-wild incident. Note also the apparent mismatch worth verifying: the title says "elevate privileges" but the CVSS impact metrics show only C:H (confidentiality) with I:N and A:N, which is unusual for a privilege escalation and may indicate the "privilege gain" manifests as unauthorized read access to protected resources rather than write/admin capability - defenders should consult the MSRC advisory to confirm exact impact.

A remote unauthenticated attacker sends crafted requests to a Microsoft Global Secure Access endpoint or Entra ID authorization API and exploits the improper privilege management flaw to obtain access or tokens scoped above their actual entitlement, allowing them to read protected configuration or identity data within a victim tenant. Because no public exploit code has been identified at time of analysis and Microsoft rates exploit code maturity as Unproven, this scenario is theoretical rather than observed, but the AV:N/AC:L/PR:N/UI:N vector means any successful weaponization would be trivially repeatable.