CVE-2026-40379
CriticalCVSS 9.3Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
Azure Entra ID has an exposure of sensitive information that allows an unauthorized attacker to perform spoofing over a network.
Risk Assessment
The organization may be vulnerable to attacks that could lead to data theft or compromise of system integrity.
Recommendation
It is recommended to implement additional security measures such as access monitoring and security audits to minimize risk.
Other vulnerabilities in Azure Entra ID
See all- CVE-2025-59246Critical
An Elevation of Privilege vulnerability has been identified in Azure Entra ID. Technical details are not provided in the description.
- CVE-2025-59218Critical
An Elevation of Privilege vulnerability in Azure Entra ID allows an attacker to gain higher privileges in the cloud environment. Technical details were not disclosed in the description.
- CVE-2025-55241Critical
Azure Entra ID Elevation of Privilege Vulnerability. Technical details are not provided in the description.
- CVE-2026-62869High
Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.
- CVE-2026-23663High
Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.
Original NVD description (English source)
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS