Microsoft Microsoft Entra
9 CVEs affecting Microsoft Microsoft Entra. Latest disclosed: 2026-05-22. Critical: 8, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42901 | Critical | 10.0 | 2026-05-22 | Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-35431 | Critical | 10.0 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-55241 | Critical | 10.0 | 2025-09-04 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-59246 | Critical | 9.8 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-59218 | Critical | 9.6 | 2025-10-09 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2026-40379 | Critical | 9.3 | 2026-05-12 | Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-24305 | Critical | 9.3 | 2026-01-22 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2026-33843 | Critical | 9.1 | 2026-05-22 | Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a n… |
CVE-2024-43477 | High | 7.5 | 2024-08-23 | Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on an… |