This Microsoft Entra ID Vulnerability Could Have Been Catastrophic (wired.com)
(Friday September 19, 2025 @05:30AM (msmash)
from the everyone-gets-admin-privileges dept.)
- Reference: 0179358590
- News link: https://it.slashdot.org/story/25/09/19/027208/this-microsoft-entra-id-vulnerability-could-have-been-catastrophic
- Source link: https://www.wired.com/story/microsoft-entra-id-vulnerability-digital-catastrophe/
Security researcher Dirk-jan Mollema discovered two vulnerabilities in Microsoft's Entra ID identity platform that could have granted [1]attackers administrative access to virtually all Azure customer accounts worldwide. The flaws involved legacy authentication systems -- Actor Tokens issued by Azure's Access Control Service and a validation failure in the retiring Azure Active Directory Graph API.
Mollema reported the vulnerabilities to Microsoft on July 14. Microsoft released a global fix three days later and found no evidence of exploitation. The vulnerabilities would have allowed attackers to impersonate any user across any Azure tenant and access all Microsoft services using Entra ID authentication. Microsoft confirmed the fixes were fully implemented by July 23 and added additional security measures in August as part of its Secure Future Initiative. The company issued a CVE on September 4.
[1] https://www.wired.com/story/microsoft-entra-id-vulnerability-digital-catastrophe/
Mollema reported the vulnerabilities to Microsoft on July 14. Microsoft released a global fix three days later and found no evidence of exploitation. The vulnerabilities would have allowed attackers to impersonate any user across any Azure tenant and access all Microsoft services using Entra ID authentication. Microsoft confirmed the fixes were fully implemented by July 23 and added additional security measures in August as part of its Secure Future Initiative. The company issued a CVE on September 4.
[1] https://www.wired.com/story/microsoft-entra-id-vulnerability-digital-catastrophe/
WTF is Entra ID (Score:4, Interesting)
by PDXNerd ( 654900 )
I had to look this up, apparently Entra ID is an evolution of ADFS or Active Directory Federation in the cloud. I guess you get what you deserve if you're using Microsoft security products in the cloud. Also, Entra ID is a terrible name but AD is a terrible product so I guess its an evolution of the same terrible security issues.
Re: (Score:2)
by arglebargle_xiv ( 2212710 )
> I guess you get what you deserve if you're using Microsoft security products in the cloud.
I guess you get what you deserve if you're using the cloud.
There, FTFY.
"and found no evidence of exploitation" (Score:2)
"granted attackers administrative access" or the attackers did a good job cleaning up!