PT-2026-40208 · Microsoft · Enterprise Security Token Service+1

Sridhar Periyasamy + 1 · Published 2026-05-07 · Updated 2026-05-16 · CVE-2026-40379

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Azure Entra ID (affected versions not specified) Microsoft Enterprise Security Token Service (affected versions not specified)

Description Exposure of sensitive information in Azure Entra ID allows an unauthorized actor to perform spoofing over a network. Additionally, errors in information processing within the Microsoft Enterprise Security Token Service, a service used for authentication and token management, could allow a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-06843

CVE-2026-40379

Affected Products

Azure Entra Id

Enterprise Security Token Service

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-40379 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06843 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-40379 · Vendor Advisory
• https://vuldb.com/vuln/362021 · Note
• https://twitter.com/lyrie_ai/status/2055698649368465536 · Twitter Post