CVE-2026-35431
Published: 23 April 2026
Summary
CVE-2026-35431 is a critical-severity SSRF (CWE-918) vulnerability in Microsoft Entra Id. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-35431 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, in Microsoft Entra ID Entitlement Management. Published on 2026-04-23T22:16:38.510, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and broad impacts across confidentiality, integrity, availability, and changed scope.
An unauthorized attacker can exploit this vulnerability remotely over the network. Exploitation enables the attacker to perform spoofing over a network, leveraging the SSRF to make unauthorized requests on behalf of the server, with potential for high confidentiality, integrity, and availability disruptions given the CVSS metrics.
The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35431.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25312
Vulnerability details
Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable SSRF vulnerability in the publicly accessible Microsoft Entra ID Entitlement Management service with no authentication required, directly matching the definition of exploiting a public-facing application for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the SSRF vulnerability by requiring timely identification, reporting, and remediation of the specific flaw in Microsoft Entra ID Entitlement Management.
Prevents SSRF exploitation by enforcing validation of untrusted inputs such as URLs that could trick the server into making unauthorized network requests.
Blocks SSRF-induced unauthorized outbound requests from the server to internal or restricted network resources through boundary protection mechanisms like firewalls or proxies.