This vulnerability in Microsoft Entra involves improper authorization that enables an attacker to elevate privileges remotely without authentication or user interaction. The CVSS 3.1 score of 9.3 reflects its critical severity, with network attack vector, low attack complexity, and scope change. Confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability is officially published and a patch is available.

Successful exploitation could allow an unauthenticated attacker to elevate privileges in Microsoft Entra, potentially leading to unauthorized access to sensitive information (high confidentiality impact) and limited integrity impact. There is no impact on availability. No known exploits are reported in the wild at this time.

An official patch is available for this vulnerability. It is recommended to apply the patch promptly to remediate the elevation of privilege issue in Microsoft Entra. Since this is not a cloud service, customer action is required to update affected systems. No additional mitigation steps are indicated by the vendor advisory.