EUVD-2026-25312
GHSA-7r3r-j3vr-c4w6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Entra Entitlement Management endpoint
-
DeliverySubmit request with attacker-controlled URL
-
ExploitService performs server-side request (SSRF)
-
ExecutionCross security boundary, spoof trusted origin
-
ImpactAccess internal resources, total impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against the Microsoft Entra ID Entitlement Management service is possible per the CVSS vector (AV:N/AC:L/PR:N/UI:N), meaning no credentials, no user interaction, and low complexity. The specific prerequisite is network reachability to the Entitlement Management functionality that processes the SSRF-triggering input; the scope-change flag (S:C) indicates the coerced request crosses into a different security authority. The main limiting factor is that this is a Microsoft-operated cloud endpoint, so the exposure window is bounded by Microsoft's server-side fix rather than by customer configuration, and the exact vulnerable parameter/feature is not disclosed in the available data. |
| Impact | The signals here are notably divergent and should be weighed carefully. CVSS is a maximal 10.0 with AV:N/AC:L/PR:N/UI:N and S:C plus C:H/I:H/A:H, indicating a network-reachable, low-complexity, unauthenticated flaw with total cross-boundary impact - reinforced by the SSVC read of Automatable:yes and Technical Impact:total. Against that, EPSS is very low at 0.07% (20th percentile), the flaw is NOT on CISA KEV, SSVC Exploitation is 'none', and no public exploit was identified, so there is no evidence of real-world attacks yet. This is a genuine high priority on impact and ease-of-exploit grounds, but the low EPSS and absence of observed exploitation suggest a serious latent risk rather than an active campaign; a key mitigating reality is that Microsoft operates and patches the service centrally, so the customer exposure window is largely controlled by the vendor's fix rollout rather than by local patching speed. |
| Exploit ScenarioDerived | A remote attacker with no credentials sends a crafted request to an internet-facing Entitlement Management endpoint containing an attacker-controlled URL or resource reference. The Entra backend follows that reference and issues a server-side request to an internal or attacker-chosen target, letting the attacker spoof a trusted identity-service origin and reach resources across the service's security boundary. No public proof-of-concept has been identified, and the low attack complexity (AC:L) means no special timing or race conditions are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Server-side request forgery in Microsoft Entra ID Entitlement Management lets a remote, unauthenticated attacker coerce the cloud service into making attacker-directed requests, enabling spoofing and full compromise of confidentiality, integrity, and availability across a security-scope boundary (CVSS 10.0). No public exploit identified at time of analysis and EPSS is low (0.07%), but the SSVC framework flags the flaw as automatable with total technical impact. As a cloud-hosted Microsoft identity service, remediation is delivered by the vendor rather than by customer patching.
RemediationAI
Patch available per vendor advisory: Microsoft has released a fix for the Entra ID Entitlement Management service, per https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35431. Because Entra ID is a Microsoft-hosted cloud service, the fix is applied server-side by Microsoft and requires no customer-installed update or version bump; administrators should confirm remediation status in the MSRC update guide and review Entra sign-in and audit logs for anomalous entitlement/access-package activity. As defense-in-depth while validating, restrict and monitor privileged access to Entitlement Management (limit catalog and access-package administrators, enforce Conditional Access and MFA on identity-governance roles) and enable alerting on unexpected access-package or connected-organization changes; note these are detective and access-limiting controls, not a substitute for the vendor fix, and do not themselves close the SSRF.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Microsoft Entra ID (formerly Azure Active Directory) Entitlement Management, the access-governance feature that automates access packages, catalogs, and lifecycle workflows for users, groups, and connected organizations. The root cause is CWE-918 (Server-Side Request Forgery): the service accepts input that influences the destination of a server-originated request without adequately validating or restricting it, allowing an attacker to make the trusted Entra backend issue requests to unintended internal or external targets. Because Entra ID is a multi-tenant cloud identity plane, the CPE (cpe:2.3:a:microsoft:microsoft_entra:*) refers to the hosted service rather than a versioned on-premises install, and the CVSS scope-change flag (S:C) reflects that the coerced request crosses the vulnerable component's security authority.
Know when Microsoft Entra gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable, unauthenticated, low-complexity SSRF that coerces the service across a security boundary (S:C) with total impact, consistent with the vendor vector.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.
Executive ViewAI
A critical vulnerability in Microsoft Entra ID Entitlement Management (CVSS 10.0) allows unauthenticated attackers to compromise your organization's identity and access management infrastructure. Since this cloud service makes all authentication and authorization decisions, its compromise is functionally equivalent to a complete security perimeter failure affecting every user, application, and system. No public exploit has been identified at time of analysis, but verification of patch deployment and forensic audit for exploitation evidence remain immediate priorities.
Apply vendor patch. Patch availability confirmed by vendor; Microsoft applies updates server-side to this cloud service. Confirm deployment status with your account team and request prioritized application if not yet deployed to your tenant.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Microsoft Entra
View allRemote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting ma
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Privilege elevation in Microsoft Entra ID (formerly Azure Active Directory) allows an authenticated, low-privileged atta
Privilege elevation in Microsoft Azure Active Directory B2C (now part of Microsoft Entra) lets a remote, unauthenticated
Exploit-DB