Dirk-Jan Mollema

**Name of the Vulnerable Software and Affected Versions** Microsoft Entra ID (affected versions not specified) **Description** A critical flaw in the authentication procedure of Microsoft Entra ID (formerly Azure Active Directory) allowed remote attackers to elevate privileges and impersonate any user, including Global Administrators, across all tenants globally. The issue stemmed from a combination of undocumented "Actor tokens"—internal tokens used for service-to-service communication—and a validation error in the legacy Azure AD Graph API. Specifically, the API failed to perform proper boundary checks on the originating tenant, allowing a token from one tenant to be used to access others. Because these tokens were unsigned and bypassed security policies like Conditional Access, exploitation could occur without triggering alarms or leaving actionable logs. This could lead to full infrastructure control, including the ability to read user profiles, extract BitLocker recovery keys, and create new Global Administrator accounts. **Recommendations** Audit all Global Administrator accounts created during the vulnerability period. Rotate all critical keys and certificates. Analyze access logs for suspicious activity. As a temporary mitigation, restrict access to the legacy Azure AD Graph API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server versions prior to the April 2025 Hot Fix **Description** A high-severity vulnerability (CVE-2025-53786) exists in Microsoft Exchange Server hybrid deployments. This vulnerability allows attackers with administrative access to on-premises Exchange servers to escalate privileges and potentially compromise cloud environments. The vulnerability stems from a shared service principal used between on-premises and Exchange Online, enabling attackers to forge trusted tokens for cloud access without generating logs. Over 29,000 Exchange servers were reported as unpatched and vulnerable. CISA issued an emergency directive mandating federal agencies to patch the vulnerability by August 11, 2025. Exploitation is considered likely. **Recommendations** Apply the April 2025 Hot Fix or later to all affected Exchange Server deployments. Implement the changes outlined in the Microsoft security guidance released on April 18, 2025. For hybrid deployments, reconfigure the hybrid application to avoid using the shared service principal. Reset service principal credentials. Run the Exchange Health Checker to verify the configuration.

**Name of the Vulnerable Software and Affected Versions** Azure Active Directory versions (affected versions not specified) **Description** The issue is related to a security feature bypass, potentially allowing remote attackers to bypass security restrictions. The problem is associated with errors in security settings, specifically in the Active Directory Federation Services (AD FS) of Windows operating systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Autopilot versions (affected versions not specified) **Description** The issue is related to a spoofing vulnerability in the Windows Autopilot Device Management and Enrollment Client. This vulnerability is associated with errors in the representation of information by the user interface. Exploitation of this issue may allow a remote attacker to conduct spoofing attacks by opening a specially crafted file. The vulnerability allows attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Active Directory integrated DNS (ADIDNS) (affected versions not specified) Description: A remote code execution issue exists due to Active Directory integrated DNS (ADIDNS) mishandling objects in memory. An authenticated attacker could exploit this by sending malicious requests to an ADIDNS server, potentially allowing them to run arbitrary code in the context of the Local System Account. The issue is related to a buffer overflow in memory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Active Directory integrated DNS (ADIDNS) (affected versions not specified) Description: A remote code execution issue exists due to Active Directory integrated DNS (ADIDNS) mishandling objects in memory. An authenticated attacker could exploit this by sending malicious requests to an ADIDNS server, potentially allowing them to run arbitrary code in the context of the Local System Account. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.