This vulnerability (CVE-2026-40379) involves the exposure of sensitive information to unauthorized actors in Microsoft Enterprise Security Token Service (ESTS), part of Azure Entra ID. The issue allows an attacker to perform spoofing over a network, leading to a breach of confidentiality and integrity. The CVSS 3.1 base score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. Microsoft has released an official fix and manages remediation for this cloud service.

An attacker exploiting this vulnerability can gain access to sensitive information by spoofing network communications, which may lead to significant confidentiality and integrity breaches within Azure Entra ID environments. There is no impact on availability reported. No known exploits are currently active in the wild.

Microsoft has provided an official fix for this vulnerability. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379 for detailed guidance and ensure their Azure Entra ID services are updated accordingly.