This vulnerability (CVE-2026-40379) in Microsoft Entra involves exposure of sensitive information to unauthorized actors, enabling network spoofing attacks. It is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. The affected product is a cloud service (Azure Entra ID), and Microsoft has released an official fix to remediate the issue.

An unauthorized attacker can exploit this vulnerability to gain access to sensitive information and perform spoofing attacks over the network. This compromises the confidentiality and integrity of data within Microsoft Entra, potentially leading to unauthorized access or manipulation of identity information. There is no known exploitation in the wild at this time.

Microsoft has released an official fix for this vulnerability. Since Microsoft Entra is a cloud service, the vendor manages remediation server-side. Users should ensure their environments are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379. No additional user action is required beyond applying the official fix.