CVE-2026-24305 is an elevation of privilege vulnerability in Microsoft Entra ID (part of Microsoft Entra) due to improper authorization (CWE-285). The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. It impacts confidentiality highly and integrity to a lesser extent, with no impact on availability. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to elevate privileges within Microsoft Entra ID, potentially gaining unauthorized access to sensitive information and performing limited unauthorized actions. The confidentiality impact is high, integrity impact is low, and availability is unaffected.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft Entra service. Administrators should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24305 for detailed patching and mitigation guidance. No additional action is required beyond applying the official fix as provided by Microsoft.