Microsoft Entra ID CVE-2026-69851

Exploitation requires the attacker to already hold valid, low-privileged authenticated access to Microsoft Entra ID (CVSS PR:L) and network reachability to the service (AV:N), with no user interaction needed (UI:N) and low attack complexity (AC:L). The concrete trigger is the SSRF condition: the attacker must be able to supply input that the Entra backend uses to build a server-side request, then direct that request to an unintended internal target to achieve the scope-crossing privilege elevation (S:C). The key limiting factor is authentication - this is not an unauthenticated internet-wide attack; an adversary must first acquire at least a low-privilege identity in the tenant, which credential controls (MFA, Conditional Access) and least-privilege role assignment directly constrain.

The signals are strongly consistent and point to a genuine high priority. The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9 critical: network-reachable, low attack complexity, only low privileges required, no user interaction, and a scope change with high confidentiality, integrity, and availability impact. The scope change (S:C) combined with SSRF-driven privilege elevation is the core risk driver, since an authorized user of one tenant/context could reach beyond their authorization. Mitigating the raw score: exploitation is not fully unauthenticated (PR:L requires the attacker to already hold valid, low-privileged credentials), and because Entra ID is a Microsoft-operated SaaS, the fix is applied service-side and customers generally cannot be left exposed by failing to patch. No EPSS score, no CISA KEV entry, and no POC were provided, so predicted exploitation probability is unquantified - treat active-exploitation risk as currently unconfirmed rather than either high or ruled out.

An attacker who has obtained low-privileged but valid Entra ID credentials (e.g., a compromised standard user or a low-tier application identity) submits crafted input to a vulnerable Entra component, coercing the backend to issue a server-side request to an internal or otherwise protected endpoint. By steering that trusted request, the attacker elevates privileges beyond their assigned scope, potentially gaining control over directory objects or resources across the security boundary. No public exploit is identified at time of analysis, so this reflects the CVSS-implied path (AV:N, AC:L, PR:L) rather than an observed campaign.