Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants
Summary: A critical token validation failure in Microsoft Entra ID, tracked as CVE-2025-55241 and rated CVSS 10.0, could have let attackers impersonate any user including Global Administrators across any tenant, according to researcher Dirk-jan Mollema, who reported it on July 14, 2025. The flaw combined service-to-service actor tokens from the Access Control Service with a legacy Azure AD Graph API that did not validate the originating tenant, and Microsoft addressed it as of July 17, 2025 with no customer action required and no indication of exploitation in the wild.
Key Takeaway: Mitiga said exploitation could bypass MFA, Conditional Access, and logging, so an attacker could take an actor token from their own non-privileged test environment and impersonate a Global Admin in another company's tenant without any pre-existing access - and the Graph API's lack of API-level logging meant access to user information, role details, and BitLocker keys would leave no trace.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2025-53786CVE-2025-55241
- Related
- Microsoft Patch Tuesday, August 2025 Edition Cyber Risks ·FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026