The issue stems from improper handling of authentication requests in the Entra ID service. An unauthenticated attacker could exploit this by sending specially crafted requests, leading to unauthorized access to resources and the ability to modify tenant configurations. Microsoft has not released a specific CVE identifier for this issue at the time of writing, but has urged all administrators to apply the update immediately.

• Affected component: Entra ID (formerly Azure Active Directory)
• Severity: Critical (CVSS 10.0)
• Attack vector: Network-based, no authentication required
• Impact: Full privilege escalation within the tenant, potential data exfiltration

The patch is available through the standard Microsoft Update channels, and the company has also provided a workaround for organizations that cannot deploy the fix immediately. Administrators are advised to review their tenant audit logs for suspicious authentication anomalies, particularly any unexpected changes to global administrator roles or conditional access policies.

Microsoft has not disclosed the full technical details of the vulnerability or the extent of the exploitation campaign, but they have confirmed that the flaw was used in targeted attacks. This is a rare instance of a maximum-severity rating, underscoring the urgency for organizations running Entra ID to prioritize this update.

Source: BleepingComputer

Is your organization already auditing Entra ID logs for signs of privilege escalation, given that no CVE ID is publicly available yet?