EUVD-2026-56779
GHSA-486h-mp6h-x926
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Cloud identity service reachable over network; low-privilege account required (PR:L); spoofing enabling full impersonation justifies C:H and I:H; A:H reflects admin impersonation enabling destructive tenant actions.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.
AnalysisAI
Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege network attacker to forge or manipulate identity data due to insufficient verification of data authenticity (CWE-345), yielding high confidentiality, integrity, and availability impact. The CVSS 8.8 score with PR:L confirms a valid tenant account is required but no elevated privileges are needed, meaning any compromised or legitimately provisioned low-privilege account could serve as a launchpad. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid, low-privilege account within the target Microsoft Entra ID tenant - described as an 'authorized attacker' in the CVE description and reflected by PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 High score is supported by a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-exploitable, low-complexity conditions requiring only a low-privilege account and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid low-privilege account in the target Entra ID tenant - obtained through phishing, credential stuffing, or a compromised service account - sends a crafted authentication request that exploits the insufficient data authenticity verification to assert a higher-privileged or different identity. The forged identity claim is accepted by Entra ID, allowing the attacker to obtain tokens or access rights belonging to another user or service principal, potentially accessing Microsoft 365 data, Azure resources, or federated SaaS applications as the impersonated account. … |
| Remediation | Because Microsoft Entra ID is a cloud-hosted service, the primary fix is applied server-side by Microsoft and typically requires no customer-initiated patching of an on-premises component. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit Entra ID logs for anomalous identity operations and review token generation events for suspicious activity patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permission
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated at
Azure Entra ID Elevation of Privilege Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today