Microsoft’s Entra ID vulnerabilities could have been catastrophic

According to WIRED, two vulnerabilities in Microsoft’s Entra ID could have allowed a attacker to gain global administrator privileges and effectively take over nearly every Entra ID tenant, exposing Azure customer accounts at scale. The flaws involved Actor Tokens issued by a legacy Access Control Service and a flaw in the Azure AD Graph API that could accept a token from another tenant, enabling full tenant compromise.

Mollema disclosed the findings to the Microsoft Security Response Center on 14 July, with Microsoft beginning remediation that day and issuing a patch globally on 17 July; Microsoft confirmed the issue was fixed by 23 July and additional measures were implemented in August. The vulnerability was assigned CVE-2025-55241 on 4 September.

Microsoft’s Security Response Center chief Tom Gallagher said the company mitigated the issue quickly and accelerated decommissioning of legacy protocol usage as part of its Secure Future Initiative, and that there was no evidence of abuse during the investigation. The discussion also references a 2023 Storm-0558 incident involving a signing key used to forge tokens, underscoring the potential impact had the flaws been exploited.