EUVD-2026-25312
GHSA-7r3r-j3vr-c4w6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable, unauthenticated, low-complexity SSRF that coerces the service across a security boundary (S:C) with total impact, consistent with the vendor vector.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Server-side request forgery in Microsoft Entra ID Entitlement Management lets a remote, unauthenticated attacker coerce the cloud service into making attacker-directed requests, enabling spoofing and full compromise of confidentiality, integrity, and availability across a security-scope boundary (CVSS 10.0). No public exploit identified at time of analysis and EPSS is low (0.07%), but the SSVC framework flags the flaw as automatable with total technical impact. As a cloud-hosted Microsoft identity service, remediation is delivered by the vendor rather than by customer patching.
Technical ContextAI
The affected component is Microsoft Entra ID (formerly Azure Active Directory) Entitlement Management, the access-governance feature that automates access packages, catalogs, and lifecycle workflows for users, groups, and connected organizations. The root cause is CWE-918 (Server-Side Request Forgery): the service accepts input that influences the destination of a server-originated request without adequately validating or restricting it, allowing an attacker to make the trusted Entra backend issue requests to unintended internal or external targets. Because Entra ID is a multi-tenant cloud identity plane, the CPE (cpe:2.3:a:microsoft:microsoft_entra:*) refers to the hosted service rather than a versioned on-premises install, and the CVSS scope-change flag (S:C) reflects that the coerced request crosses the vulnerable component's security authority.
RemediationAI
Patch available per vendor advisory: Microsoft has released a fix for the Entra ID Entitlement Management service, per https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35431. Because Entra ID is a Microsoft-hosted cloud service, the fix is applied server-side by Microsoft and requires no customer-installed update or version bump; administrators should confirm remediation status in the MSRC update guide and review Entra sign-in and audit logs for anomalous entitlement/access-package activity. As defense-in-depth while validating, restrict and monitor privileged access to Entitlement Management (limit catalog and access-package administrators, enforce Conditional Access and MFA on identity-governance roles) and enable alerting on unexpected access-package or connected-organization changes; note these are detective and access-limiting controls, not a substitute for the vendor fix, and do not themselves close the SSRF.
More in Microsoft Entra
View allRemote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting ma
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Privilege elevation in Microsoft Entra ID (formerly Azure Active Directory) allows an authenticated, low-privileged atta
Privilege elevation in Microsoft Azure Active Directory B2C (now part of Microsoft Entra) lets a remote, unauthenticated
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today