CVE-2025-55241

Published Sep 4, 2025

Last updated 2 days ago

Microsoft Azure Entra

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-55241 is an elevation of privilege vulnerability affecting Microsoft Azure Entra ID. It is categorized under CWE-287 (Improper Authentication). An attacker can exploit a flaw in Azure Entra's code that incorrectly manages permissions by sending a specially crafted request to elevate their privilege level. This could lead to unauthorized data access or manipulation, potentially compromising the system's integrity and confidentiality. As of September 2025, there are no public technical details, exploitation code, or root cause analysis available for this specific vulnerability. However, similar Azure Entra ID privilege escalation vulnerabilities involve service principal permission abuse, OAuth scope misconfigurations, hybrid identity synchronization weaknesses, and exploitation of undocumented permissions in Microsoft first-party applications. Applying the vendor's patch is the best way to mitigate this vulnerability.

Description: Azure Entra Elevation of Privilege Vulnerability
Source: secure@microsoft.com
NVD status: Modified
CNA Tags: exclusively-hosted-service
Products: entra_id

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secure@microsoft.com: CWE-287

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 27

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D09E509F-AFF3-4991-877A-D197388E7AD4"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.