EUVD-2026-54315
GHSA-4fjg-rvvj-3c6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege tenant account
-
DeliveryCraft request modifying assumed-immutable identity data
-
ExploitBypass authorization check via tampered value
-
ExecutionElevate to higher-privileged access
-
ImpactAccess confidential tenant resources
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires an attacker to already hold a low-privileged but authenticated identity within an Azure AD / Entra ID tenant (CVSS PR:L), reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The specific limiting factor is that the attacker must possess valid low-level credentials or a foothold account in the target tenant before tampering with the assumed-immutable data; it is not exploitable by a fully anonymous, unauthenticated internet attacker. The exact feature or configuration that exposes the mutable data was not detailed in the available intelligence and must be confirmed against the MSRC advisory. |
| Impact | The available signals are strong but incomplete. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) indicates network-reachable, low-complexity exploitation needing only low privileges and no user interaction, with a scope change and high confidentiality/integrity impact - a combination that legitimately yields the 9.9 base score. However, no EPSS score, KEV status, or POC data was provided, so real-world exploitation likelihood cannot be quantified; exploitation status is therefore 'no public exploit identified at time of analysis' rather than confirmed active exploitation. A signal conflict should be flagged: the vendor tag says 'Information Disclosure' while CWE-471 and the I:H/scope-change profile point to privilege elevation - verify the precise impact against the MSRC advisory. For a cloud identity backbone like Entra ID, even an unproven flaw of this severity warrants urgent attention because Microsoft typically remediates it service-side. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privileged account in a tenant (via phishing, credential stuffing, or a compromised guest/service account) sends crafted requests that modify identity data the service assumes cannot change, causing an authorization check to grant elevated rights. Because scope changes (S:C), the attacker pivots from a constrained account into broader tenant-level access. No public proof-of-concept is known at time of analysis, so this scenario is inferred from the CVSS vector rather than a demonstrated exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 07, 2026
Privilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacker tamper with data the platform treats as immutable to gain higher-privileged access over a network. The CVSS 3.1 score of 9.9 reflects a scope change (S:C), meaning the compromise crosses the security boundary of the low-privilege account into the broader identity tenant. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV; note that despite Microsoft's 'Information Disclosure' tag, the CWE and CVSS impact metrics actually describe an elevation-of-privilege condition.
RemediationAI
No vendor-released patch version was identified in the provided data; because Azure Active Directory / Entra ID is a Microsoft-operated cloud service, remediation is typically applied server-side by Microsoft without customer action, so administrators should confirm current fix status directly at the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50481). As compensating controls while confirming remediation, restrict and audit low-privilege accounts (the exploitation prerequisite per PR:L), enforce Conditional Access and phishing-resistant MFA to limit who can obtain the authenticated foothold, review privileged role assignments and directory audit logs for anomalous elevation or attribute modification, and enable Microsoft Entra ID Protection risk-based policies. The trade-off of tightening Conditional Access is friction for legitimate low-privilege users, and aggressive log review adds analyst overhead, but both are low-risk relative to an identity-plane compromise.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Azure Active Directory (now branded Microsoft Entra ID) is Microsoft's cloud identity and access management service underpinning authentication and authorization for Microsoft 365, Azure, and countless integrated third-party applications. The root cause is CWE-471, Modification of Assumed-Immutable Data (MAID): the service trusts certain data (for example claims, tokens, identifiers, or directory object attributes) as unchangeable after issuance or assignment, but an attacker can alter that data because it is not adequately protected or re-validated server-side. When an authorization decision relies on such assumed-immutable values, tampering with them grants rights that were never assigned. No CPE strings were supplied in the intelligence, so exact affected service components or client library versions must be obtained from the Microsoft Security Response Center advisory.
Know when Azure Active Directory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Network elevation needs a low-privileged authenticated foothold (PR:L), no user interaction, and crosses the account boundary into the tenant (S:C) with high confidentiality/integrity impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
A critical privilege escalation vulnerability in Microsoft Azure Active Directory (Entra ID) enables low-privileged authenticated users to escalate to higher privileges, potentially compromising entire tenant environments. All organizations using Entra ID for access control face immediate risk of unauthorized administrative access and tenant-wide compromise. The absence of a vendor patch requires urgent implementation of compensating controls and enhanced monitoring.
Enforce multi-factor authentication (MFA) on all Entra ID authentications; restrict privilege elevation through Conditional Access policies requiring geolocation and device compliance verification; implement Privileged Identity Management (PIM) with just-in-time (JIT) role activation and mandatory approval workflows; isolate administrative accounts to Privileged Access Workstations (PAWs) with network segmentation; enable enhanced audit logging for all identity operations; implement daily automated review and alerting for privilege escalation attempts; disable legacy authentication protocols; enforce risk-based Conditional Access using Azure AD identity protection signals.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Azure Active Directory
View allPrivilege escalation in Microsoft Azure Active Directory allows unauthenticated remote attackers to bypass authenticatio
Denial of service in Microsoft Azure Active Directory (now Entra ID) allows a remote, unauthenticated attacker to disrup
An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as
Denial of service in Microsoft Azure Active Directory (Entra ID) allows a remote unauthenticated attacker to send networ
Microsoft Azure Active Directory B2C Spoofing Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is rem
Exploit-DB