This vulnerability, identified as CWE-918, affects Microsoft Entra ID Entitlement Management and enables an attacker without privileges or user interaction to exploit SSRF to spoof network requests. The CVSS 3.1 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Successful exploitation of this SSRF vulnerability can lead to an attacker gaining unauthorized access to internal network resources or services by spoofing network requests. The impact includes full compromise of confidentiality, integrity, and availability of affected systems or data within the scope of Microsoft Entra ID Entitlement Management.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35431 promptly to remediate this vulnerability.