Executive brief
Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud-based identity and access management service used by organizations worldwide to control who can access corporate applications and data. A missing authorization check allows an authenticated attacker to escalate their privileges within Entra ID, potentially gaining unauthorized access to sensitive applications and data across the organization's cloud infrastructure.
Technical details
The vulnerability is a missing authorization check in Microsoft Entra ID that permits privilege escalation. An attacker with valid credentials can exploit this flaw to elevate their permissions beyond their assigned role, potentially gaining administrative access or access to sensitive resources. The attack is network-reachable and requires an authenticated account but does not require additional user interaction. This authorization bypass enables an attacker to assume higher-privilege roles and perform administrative actions they are not entitled to perform. Microsoft has released a security update to address this vulnerability.
Affected products
- Microsoft Entra ID
Timeline
- 2026-09-08: disclosed