Microsoft Entra EUVD-2026-31519

The vulnerability requires the target organization to be using Azure AD B2C (Microsoft Entra) as its identity/authentication provider, and exploitation abuses an 'alternate path or channel' (CWE-288) to reach privileged functionality - i.e. a secondary authentication endpoint or token flow that fails to enforce the primary checks. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no privileges, and no user interaction are needed, so a remote unauthenticated attacker can attempt it over the network against a B2C-enabled tenant. The chief limiting factor is that the affected component is a Microsoft-hosted cloud service: Microsoft's server-side remediation ('Reported by: microsoft', patch available) removes the alternate path for tenants once applied, so realistic exposure is confined to any window before the service-side fix takes effect and there is no on-premises install for attackers to target.

The signals here partly conflict and should be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and the SSVC assessment (Automatable: yes, Technical Impact: total) both point to a serious, easily reachable, high-impact identity flaw. Against that, the SSVC exploitation status is 'none', there is no CISA KEV listing, no public POC, and EPSS is only 0.05% (16th percentile), indicating exploitation is not currently observed or predicted to be widespread. This combination is typical of a Microsoft-discovered ('Reported by: microsoft') cloud-service vulnerability remediated largely server-side before disclosure, which lowers practical urgency for tenants even though the theoretical severity is critical. Because the affected component is a hosted Microsoft identity service, patching is primarily Microsoft's responsibility, further reducing the customer-side exposure window. Net: treat as high-severity by design impact but not an active-exploitation emergency; verify the tenant is on the remediated service.

A remote attacker who has not authenticated crafts requests to an alternate authentication path or channel in a target's Azure AD B2C tenant, sidestepping the normal sign-in and consent checks to obtain a privileged/authenticated session for a relying application. Per the CVSS vector this requires only network access with low complexity and no user interaction, and SSVC rates it automatable - meaning the flow could be scripted at scale. No public exploit code has been identified at time of analysis.