CVE-2025-55241
Published: 04 September 2025
Summary
CVE-2025-55241 is a critical-severity Improper Authentication (CWE-287) vulnerability in Microsoft Entra Id. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and IA-5 (Authenticator Management).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-55241 by requiring timely flaw remediation and patching of the Azure Entra ID elevation of privilege vulnerability.
Addresses improper authentication (CWE-287) by enforcing secure management, validation, and protection of authenticators such as actor tokens exploited in this vulnerability.
Limits the impact of privilege escalation to global admin by enforcing the principle of least privilege on accounts and associated tokens in Entra ID tenants.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote privilege escalation via improper actor token handling to global admin in Entra ID maps to exploitation for priv-esc, cloud valid accounts abuse, and application access token misuse.
NVD Description
Azure Entra ID Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2025-55241 is an Elevation of Privilege vulnerability affecting Azure Entra ID. Published on 2025-09-04T23:15:32.960, it carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-287 (Improper Authentication).
Unauthenticated attackers (PR:N) can exploit the vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation enables privilege escalation with a changed scope (S:C), resulting in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). Research indicates attackers can leverage actor tokens to obtain global admin access in Entra ID tenants.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241 details mitigation and patching information. Independent analysis at https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ provides further technical insights into the actor token exploitation technique.
Details
- CWE(s)