PT-2025-41482 · Microsoft · Azure Entra Id

Dylan Ryan-Zilavy · Published 2025-10-09 · Updated 2025-10-28 · CVE-2025-59246

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Azure Entra ID (affected versions not specified)

Description A critical elevation of privilege flaw exists in Azure Entra ID (formerly Azure Active Directory). An attacker with network access can escalate privileges, potentially gaining administrative or higher-level access without authorization. The vulnerability allows unauthenticated attackers to gain full system control. No information is available regarding the number of potentially affected devices worldwide or any real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-12829

CVE-2025-59246

Affected Products

Azure Entra Id

References · 11

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59246 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12829 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59246 · Security Note
• https://t.me/msrcreports/2183 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1976409938185314751 · Twitter Post
• https://t.me/cveNotify/139071 · Telegram Post
• https://twitter.com/CveTodo/status/1976405834985836786 · Twitter Post
• https://twitter.com/offseq/status/1976438166857908684 · Twitter Post
• https://twitter.com/samilaiho/status/1976600095484215520 · Twitter Post
• https://reddit.com/r/drbinary/comments/1oic7d3/critical_cyber_threats_october_27_2025_chatgpt · Reddit Post
• https://roboshadow.com/blog/patch-tuesday-october-2025 · Reddit Post