This vulnerability (CVE-2026-40379) in Microsoft Entra involves exposure of sensitive information to unauthorized actors, enabling spoofing over a network. It is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. The vulnerability affects the cloud service Microsoft Entra, and Microsoft has released an official fix to address it.

An attacker can exploit this vulnerability to gain unauthorized access to sensitive information within Microsoft Entra, potentially leading to spoofing attacks that compromise confidentiality and integrity of data. There is no reported impact on availability. No known exploits are currently in the wild.

Microsoft has released an official fix for this vulnerability. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379 to ensure their environments are protected.