This vulnerability, identified as CWE-346 (Origin Validation Error), affects Microsoft Entra and allows an attacker to bypass origin checks, leading to unauthorized privilege escalation remotely without user interaction. The CVSS 3.1 vector indicates the attack is network-based with low complexity, no privileges required, and no user interaction, resulting in a complete system compromise. Microsoft has published an official fix to address this security flaw.

Successful exploitation of this vulnerability can lead to full compromise of affected Microsoft Entra instances, including unauthorized privilege escalation and complete loss of confidentiality, integrity, and availability. Given the critical CVSS score of 10, the impact is severe and could allow attackers to control the system remotely.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42901 as soon as possible to remediate this vulnerability.