EUVD-2026-54315
GHSA-4fjg-rvvj-3c6q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Network elevation needs a low-privileged authenticated foothold (PR:L), no user interaction, and crosses the account boundary into the tenant (S:C) with high confidentiality/integrity impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacker tamper with data the platform treats as immutable to gain higher-privileged access over a network. The CVSS 3.1 score of 9.9 reflects a scope change (S:C), meaning the compromise crosses the security boundary of the low-privilege account into the broader identity tenant. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV; note that despite Microsoft's 'Information Disclosure' tag, the CWE and CVSS impact metrics actually describe an elevation-of-privilege condition.
Technical ContextAI
Azure Active Directory (now branded Microsoft Entra ID) is Microsoft's cloud identity and access management service underpinning authentication and authorization for Microsoft 365, Azure, and countless integrated third-party applications. The root cause is CWE-471, Modification of Assumed-Immutable Data (MAID): the service trusts certain data (for example claims, tokens, identifiers, or directory object attributes) as unchangeable after issuance or assignment, but an attacker can alter that data because it is not adequately protected or re-validated server-side. When an authorization decision relies on such assumed-immutable values, tampering with them grants rights that were never assigned. No CPE strings were supplied in the intelligence, so exact affected service components or client library versions must be obtained from the Microsoft Security Response Center advisory.
RemediationAI
No vendor-released patch version was identified in the provided data; because Azure Active Directory / Entra ID is a Microsoft-operated cloud service, remediation is typically applied server-side by Microsoft without customer action, so administrators should confirm current fix status directly at the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50481). As compensating controls while confirming remediation, restrict and audit low-privilege accounts (the exploitation prerequisite per PR:L), enforce Conditional Access and phishing-resistant MFA to limit who can obtain the authenticated foothold, review privileged role assignments and directory audit logs for anomalous elevation or attribute modification, and enable Microsoft Entra ID Protection risk-based policies. The trade-off of tightening Conditional Access is friction for legitimate low-privilege users, and aggressive log review adds analyst overhead, but both are low-risk relative to an identity-plane compromise.
More in Azure Active Directory
View allPrivilege escalation in Microsoft Azure Active Directory allows unauthenticated remote attackers to bypass authenticatio
Denial of service in Microsoft Azure Active Directory (now Entra ID) allows a remote, unauthenticated attacker to disrup
An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as
Denial of service in Microsoft Azure Active Directory (Entra ID) allows a remote unauthenticated attacker to send networ
Microsoft Azure Active Directory B2C Spoofing Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is rem
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today