PT-2026-34762 · Microsoft · Entra Id Entitlement Management

Felix B · Published 2026-04-23 · Updated 2026-04-30 · CVE-2026-35431

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Entra ID Entitlement Management (affected versions not specified)

Description Server-side request forgery (SSRF) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. This flaw enables exploitation via crafted requests, which may impact confidentiality, integrity, and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-06838

CVE-2026-35431

Affected Products

Entra Id Entitlement Management

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-35431 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35431 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06838 · Security Note
• https://twitter.com/UpwindMDR/status/2047594001658741000 · Twitter Post
• https://twitter.com/OrizonCyber/status/2047518436880740792 · Twitter Post
• https://twitter.com/schnieds/status/2049836806544536044 · Twitter Post
• https://twitter.com/CVEnew/status/2048168378662371599 · Twitter Post
• https://twitter.com/windowsforum/status/2047492397634912638 · Twitter Post
• https://t.me/cveNotify/161239 · Telegram Post