EUVD-2026-31522
GHSA-2jpj-7p7q-hfqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Entra ID endpoint
-
DeliveryCraft request with spoofed origin
-
ExploitBypass origin validation check
-
ExecutionObtain elevated tokens or privileges
-
ImpactAccess cross-tenant or privileged resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Microsoft Entra ID, per CVSS AV:N/AC:L/PR:N/UI:N. The only prerequisite is network reachability to Entra ID endpoints, which are public internet-facing by design. Limiting factors: exploit code maturity is rated Unproven (E:U) in the CVSS temporal vector, no public POC is identified, and the underlying flaw resides in Microsoft's cloud infrastructure rather than customer-controlled software - meaning Microsoft can (and per the advisory has) mitigated it server-side, narrowing the realistic exploitation window. |
| Impact | This is a maximum-severity issue (CVSS 10.0) with the worst possible exploitability profile per the vector: network-reachable (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and a changed scope (S:C) indicating cross-boundary impact - critical for a multi-tenant identity service. The temporal metrics moderate this somewhat: Exploit Code Maturity is Unproven (E:U), an Official Fix is available (RL:O), and the report is Confirmed (RC:C) by Microsoft itself. No EPSS score, KEV listing, or public POC was provided in the available data, suggesting exploitation is theoretical at this time despite the catastrophic potential impact. Because Entra ID is a cloud-hosted Microsoft service, mitigation is largely handled server-side by Microsoft rather than requiring customer patching, which changes the risk calculus versus on-prem products of similar severity. |
| Exploit ScenarioDerived | A remote unauthenticated attacker crafts a request to an Entra ID endpoint that improperly validates the request origin, causing the service to treat the request as if it came from a trusted origin (such as a first-party Microsoft application or a trusted tenant). This allows the attacker to obtain tokens, perform actions, or assume privileges they do not legitimately hold, potentially crossing tenant boundaries (consistent with CVSS scope:changed). No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 22, 2026
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain elevated privileges across tenant boundaries (scope-changed). The CVSS 10.0 rating reflects maximum impact across confidentiality, integrity, and availability with no authentication or user interaction required, though no public exploit has been identified at time of analysis and EPSS data is not provided.
RemediationAI
Patch available per vendor advisory - Microsoft has indicated a fix is available via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42901. As Entra ID is a Microsoft-hosted cloud service, the remediation is applied server-side by Microsoft and does not require customer action to deploy code patches. Customers should nonetheless review Entra ID sign-in logs and audit logs for anomalous token issuance, unexpected cross-tenant access, or unusual application consent activity during the pre-disclosure window, enforce Conditional Access policies requiring compliant devices and MFA for privileged roles, and ensure Privileged Identity Management (PIM) is used for just-in-time elevation to limit standing privileges that an origin-validation bypass could be combined with.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service used for authentication, single sign-on, and authorization across Microsoft 365, Azure, and federated third-party applications. The root cause is CWE-346 (Origin Validation Error), where the service fails to correctly verify the origin or source of a request, allowing requests from untrusted origins to be processed as if they came from trusted contexts. In identity provider contexts, origin validation failures typically affect token issuance, OAuth/OIDC flows, or cross-tenant request handling, enabling attackers to impersonate trusted callers or cross security boundaries.
Know when Microsoft Entra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
A critical vulnerability in Microsoft Entra ID (CVE-2026-42901) allows attackers to remotely gain unauthorized administrative access to user accounts and systems across organizational tenant boundaries without requiring credentials. With a CVSS score of 10.0, this poses immediate risk to any organization using Entra ID for identity management. Immediate patching is essential to prevent unauthorized access to corporate accounts, applications, and sensitive data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Microsoft Entra
View allRemote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting ma
Server-side request forgery in Microsoft Entra ID Entitlement Management lets a remote, unauthenticated attacker coerce
Privilege elevation in Microsoft Entra ID (formerly Azure Active Directory) allows an authenticated, low-privileged atta
Privilege elevation in Microsoft Azure Active Directory B2C (now part of Microsoft Entra) lets a remote, unauthenticated
Exploit-DB