EUVD-2026-38086
GHSA-rfvj-frr3-5qvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target Azure AD tenant
-
DeliverySend crafted request to auth endpoint
-
ExploitBypass identity verification
-
ExecutionObtain privileged token
-
PersistAccess federated resources cross-tenant
-
ImpactExfiltrate data or persist via app registrations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Azure Active Directory, per CVSS AV:N/AC:L/PR:N/UI:N. The only practical limiter is network reachability to Azure AD authentication endpoints (login.microsoftonline.com and related), which is by design exposed to the public internet for every tenant, so essentially every Azure AD / Entra ID customer is in scope unless Microsoft has already deployed a server-side fix. The supplied description does not enumerate any product feature, configuration toggle, or deployment mode that must be enabled, and no platform-specific or client-version preconditions are indicated. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H represents the worst-case profile: network-reachable, no authentication, no user interaction, low complexity, and a scope change with full CIA impact - hence the 10.0 score. EPSS data was not provided, and the CVE is not listed in CISA KEV in the input, so there is no public exploit identified at time of analysis; however, an unauthenticated network-reachable auth bypass in a global identity provider is a top-tier target and high-value for threat actors. The Microsoft Security Response Center reporter (secure@microsoft.com) and the 'Authentication Bypass' tag corroborate the CVSS characterization. Key data is missing: no description of the specific attack precondition, no fix version, and no confirmation of patch deployment status - for a cloud service this is often handled server-side by Microsoft transparently, but customers cannot independently verify mitigation without further advisory detail. |
| Exploit ScenarioDerived | An unauthenticated attacker on the public internet crafts a request to an Azure AD authentication endpoint that bypasses identity verification, obtaining a token or session that asserts a privileged identity (for example, a Global Administrator) in a target tenant. Because the CVSS scope is Changed, the attacker then pivots from the identity plane to downstream Microsoft 365 mailboxes, SharePoint, Azure subscriptions, and any SaaS application federated to that tenant. No public exploit identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N profile means exploitation would be straightforward once the technique is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 19, 2026
Privilege escalation in Microsoft Azure Active Directory allows unauthenticated remote attackers to bypass authentication controls and gain elevated access across tenant boundaries. With a maximum CVSS score of 10.0 and a scope-changing impact, successful exploitation could compromise identity, access, and resources federated through Azure AD. No public exploit identified at time of analysis, but the trivial attack complexity and network-reachable vector make this a top-priority issue for any organization relying on Azure AD for identity.
RemediationAI
Because Azure AD is a Microsoft-operated cloud service, the primary remediation path is server-side mitigation by Microsoft rather than a customer-installed patch; patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45480, which customers should review to confirm whether tenant action (e.g., rotating refresh tokens, revoking sessions, updating libraries like MSAL/ADAL, or reconfiguring federation) is required. As compensating controls while validating the fix, enforce Conditional Access policies that require compliant devices and trusted network locations, require phishing-resistant MFA (FIDO2/Windows Hello) for privileged roles, restrict legacy authentication protocols, and monitor sign-in logs for anomalous token issuance - note that aggressive conditional access can break legitimate B2B/guest workflows and service principal authentications, so test in report-only mode first. Consider revoking all refresh tokens for privileged accounts via Revoke-AzureADUserAllRefreshToken to force re-authentication once Microsoft confirms the issue is remediated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Azure Active Directory (now branded Microsoft Entra ID) is Microsoft's cloud identity and access management service used to authenticate users and applications across Microsoft 365, Azure, and federated third-party SaaS. The root-cause class CWE-287 (Improper Authentication) means the service fails to correctly verify that a principal is who it claims to be - examples include token validation flaws, missing signature checks, replayable assertions, or logic errors that accept malformed credentials. Because Azure AD issues OAuth 2.0/OIDC tokens and SAML assertions consumed by downstream resources, an authentication flaw at the identity provider cascades into any application trusting those tokens. No specific CPE strings were provided in the input to narrow the affected component (sign-in service, token issuance, B2B/B2C, federation, etc.).
Know when Azure Active Directory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable auth bypass in an identity provider yields PR:N/UI:N/AC:L; scope changes because compromised IdP impacts downstream relying parties with full CIA loss.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Azure Active Directory is vulnerable to a critical authentication bypass (CVE-2026-45480, CVSS 10.0) that allows unauthenticated remote attackers to escalate privileges and cross tenant boundaries. This vulnerability compromises the foundational identity and access control mechanism relied upon across most enterprise cloud infrastructure, exposing all federated users and resources to unauthorized access. Immediate detection and remediation are required to prevent full-scale identity compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce mandatory MFA across all users, implement IP-based conditional access to restrict authentication to trusted networks, disable legacy authentication protocols, enable and monitor Azure AD sign-in risk detection and anomalous activity alerts, restrict cross-tenant access policies to explicitly approved partners only, and conduct continuous audits of privilege assignments and access grants.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Azure Active Directory
View allPrivilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacke
Denial of service in Microsoft Azure Active Directory (now Entra ID) allows a remote, unauthenticated attacker to disrup
An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as
Denial of service in Microsoft Azure Active Directory (Entra ID) allows a remote unauthenticated attacker to send networ
Microsoft Azure Active Directory B2C Spoofing Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is rem
Exploit-DB