Elevation of Privilege Vulnerability in Azure Entra ID by Microsoft
CVE-2026-24305

9.3CRITICAL

Key Information:

Vendor

Microsoft
Status
Microsoft Entra
Vendor
CVE Published:
22 January 2026

What is CVE-2026-24305?

Azure Entra ID has a serious elevation of privilege vulnerability, allowing an attacker to gain unauthorized access to system resources. This can lead to potential exploitation, where attackers may manipulate user roles and permissions, increasing their access within the environment. It's crucial for organizations utilizing Azure Entra ID to stay informed and apply the latest security patches to mitigate this risk. For more details and updates, refer to the official vendor advisory.

Affected Version(s)

Microsoft Entra -

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.