EUVD-2026-41442
GHSA-29v8-q543-pf5w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SSRF requiring a low-privileged authenticated identity (PR:L), no user interaction, with total impact per SSVC on the identity fabric yields C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation via server-side request forgery affects the Microsoft Entra Provisioning Service (SyncFabric), where an authenticated attacker with low privileges can coerce the service into making attacker-controlled network requests to reach internal endpoints and elevate privileges across the identity provisioning fabric. Microsoft has released a fix through MSRC; there is no public exploit identified at time of analysis, and SSVC rates exploitation as none with an EPSS of 0.64%. The high CVSS of 8.8 is driven by total technical impact (C:H/I:H/A:H) against a cloud identity control plane.
Technical ContextAI
The affected component is Microsoft Entra Provisioning Service (SyncFabric), the cloud identity synchronization backbone that provisions and deprovisions user and group objects between Entra ID (formerly Azure AD) and downstream applications, on-premises directories, and SCIM/HR-driven targets. The root cause is CWE-918 (Server-Side Request Forgery): the service accepts input that influences the destination of an outbound request without adequate validation, allowing an attacker to redirect that request to unintended internal or metadata endpoints. In a cloud multi-tenant provisioning fabric, SSRF is especially dangerous because the service holds broad, privileged trust relationships and internal network reachability that a normal tenant user does not - turning a request-forgery primitive into a privilege-elevation path. The single affected CPE is cpe:2.3:a:microsoft:microsoft_entra_provisioning_service, a Microsoft-operated cloud service rather than customer-installed software.
RemediationAI
Because Microsoft Entra Provisioning Service is a cloud-hosted service, remediation is primarily vendor-side: Microsoft reports a patch is available and has been rolled out through the service, so no customer-installed update is required - review the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57100 for confirmation of remediation status and any tenant-side guidance. Customers should treat this as an assurance and hardening exercise: verify tenant provisioning configurations, review Entra audit and provisioning logs for anomalous outbound requests or unexpected privilege changes over the exposure window, and apply least-privilege to accounts that can configure or invoke provisioning (since PR:L means a low-privileged authenticated identity is the entry point). Reducing the number of accounts with provisioning-configuration rights and enabling conditional access / MFA on those accounts limits who could reach the vulnerable code path, at the trade-off of added administrative friction. No customer patch version applies here, so do not expect a KB or build number.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today