Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-59246 is an elevation of privilege vulnerability in Azure Entra ID (rated Critical, CVSS 9.8). Microsoft fixed it in the service; customers need to do nothing.
1 version
Facts
- Microsoft id
CVE-2025-59246- Products
- Azure Entra ID
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation More Likely
- Customer action required
- No
- Release
- 2025-Oct
- Assigned by
- Microsoft
- Weakness
- CWE-306: Missing Authentication for Critical Function
- MSRC revision
- 1.0
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2025-10-09:
Information published.
Microsoft says
Azure Entra ID Elevation of Privilege Vulnerability
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page