CVE-2025-55241

Published Sep 4, 2025

Last updated 2 months ago

Microsoft Azure Entra

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-55241 is an elevation of privilege vulnerability affecting Microsoft Azure Entra ID. It is categorized under CWE-287 (Improper Authentication). An attacker can exploit a flaw in Azure Entra's code that incorrectly manages permissions by sending a specially crafted request to elevate their privilege level. This could lead to unauthorized data access or manipulation, potentially compromising the system's integrity and confidentiality. As of September 2025, there are no public technical details, exploitation code, or root cause analysis available for this specific vulnerability. However, similar Azure Entra ID privilege escalation vulnerabilities involve service principal permission abuse, OAuth scope misconfigurations, hybrid identity synchronization weaknesses, and exploitation of undocumented permissions in Microsoft first-party applications. Applying the vendor's patch is the best way to mitigate this vulnerability.

Description: Azure Entra ID Elevation of Privilege Vulnerability
Source: secure@microsoft.com
NVD status: Modified
CNA Tags: exclusively-hosted-service
Products: entra_id

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secure@microsoft.com: CWE-287

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D09E509F-AFF3-4991-877A-D197388E7AD4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.