Latest Job Opportunities in India
Discover top job listings and career opportunities across India. Stay updated with the latest openings in IT, government, and more.
Check Out Jobs!Read More
✨ Discover Entra Critical defect that enables the impersonation of the global supervisor through the tenants corrected by Microsoft –
— everything you need to know
In this post:
Publishing views: 1
Entra Critical defam
“Microsoft has corrected a weak defect that allows the global person to imitate all over the tenants.”
The attackers could have been able to assume the identity of any user, including global officials, via any tenant due to a special code error in Microsoft Entra Id (azure active directory previously).
The maximum CVSS 10.0 to the weakness is set, which is recorded as CVE-2025-55241. Microsoft has indicated this as a loophole in Entra Azure. There is no evidence that the problem was used in the wild.
As of July 17, 2025, the Windows manufacturer has repaired; Thus, there is no necessary customer work.
Dirk Jean Molima, security researcher
| According to the security researcher Dirk-Jan Mollema, who found weakness and disclosure on July 14, it allowed the settlement of all Entra ID tenants around the world, most likely with the exception of national cloud publishing operations. Since Azure Resources is administered at the tenant level, global supervisors have the ability to give themselves permissions on Azure, “will also provide unrestricted access to every resource found in Azure.” |
The use of actors icons to service to the service (S2S) issued by the access control service (ACS) and the deadly defect in the AZURE AD LEGY (Graph.windows.net) that failed to verify the original tenant’s health.
This is important because the bad actor who gets a system programming interface can change the symbols without permission because they are subject to conditional access restrictions from Microsoft.
To exacerbate the situation, make API deficiency in the API level recording application interface to access the settings of tenants, application permissions, group and role details, device information, bitlocker keys with ENTRA, and user data stored in Entra ID without leaving any guide.
The complete settlement of tenants can result from the attacker’s impersonation from the global official and access to any service that uses the Entra ID for approval, including SharePoint Online and Exchange Online, by creating new accounts, or giving themselves additional permissions, or sensitive data.
Access via the tenant is a type of “distinctive high access” (HPA), according to Microsoft, which “occurs when the application or service gets wide access to the customer’s content, allowing it to impersonate other users without providing any evidence of the user’s context.”
It is worth noting that the technology giant advises users to switch their applications to Microsoft Graph where API Azure Ad Graph API is officially neglected and removed from August 31, 2025. 2019 witnessed the first announcement of neglect.
Microsoft
| Microsoft declared in the last part of June 2025: “The applications that have been formed for expanded access that are still dependent on Azure Ad Graph APIS will not be able to continue using these applications programming facades that start in early September 2025.” |
Mitiga, cloud safety company
| A successful exploitation of CVE-2025-55241, according to the cloud safety company Mitiga, can overcome conditional access, authentication of multiple factors (MFA), and leave any trace of occurrence. |
Roy Sherman, Metiga
| “These symbols may be designed by the attackers to deceive the Entra ID to believe that they are anyone, anywhere.” “Weakness occurred as a result of the ancient API’s inability to verify the source of the tenant, the distinctive symbol.” This implicitly means that the infiltrator may mimic a global official in renting any other company by obtaining a representative icon from his test environment. The targeted organization did not require any prior access to the attacker to get the entry. |
In the past, Mollema has also described a highly popular security vulnerability that may give an attacker high in some situations that affect the local versions of the Exchange (CVE-2025-53786, CVSS Score: 8.0).
Another study has discovered that ordinary people can carry out an ESC1 attack against Active Directory by abuse of miscarriages in the InTune certificate (such as sabotage IDS).
This advertisement follows weeks after Haakon Holm Gulbrandsrud revealed that access can be obtained via the tenant by using the API Manager joint (APIM) that supports software connections from AZURE Resources.
Gulbrandsrud
| “Anyone can fully equal to any other connection in the world using API connections, providing completely access to the associated back interface.” “This includes any externally connected service, such as Jira or Salesforce, as well as a cross -settlement to the Azure SQL databases and major arrests.” |
It also comes after many cloud weaknesses and attack techniques in recent weeks:
- Even with a personal Microsoft account, the formation of poor discrimination in Entra ID Oauth allowed unauthorized access to Microsoft Engineering Hub Resue, and exposed 22 internal service and relevant data.
- The attack that benefits from the ability to transfer the known folder (KFM) in Microsoft OneDrive for Business, which enables a harmful representative to access applications and files coinciding with SharePoint via the Internet by infiltrating the Microsoft 365 user with OneDrive synchronization.
- The AZURURAD application data has been leaked in the AppSetts.json app
- In order to extract the Amazon Web Services (AWS) keys for the sand box environment inside the exhibition box at risk, a hunting attack with a link with the harmful Oauth application registered in Microsoft Azure deceived the user to give him permissions.
This allowed the actors that are not known to include AWS permissions and benefit from the relationship of trust between the sand fund and production environments to raise concessions, and obtain full control of the AWS infrastructure for the institution, and the organization’s sensitive data.
- In order to prejudice cloud resources by obtaining temporary security accreditation data linked to the role of IAM for example, the attack that benefits from the forgery defects by the SSRF in web applications to send requests to the Metadata Aws EC2 service to access the IMDS data service (IMDS).
- By setting the specific storage bucket policies, a security vulnerability can be used now in the AWS reliable tool for consultants to circumvent the S3 safety checks and make the tool incorrectly reports of the S3 dungeons exposed to the public as safe, leaving sensitive data exposed to databases and data processing.
- Awsdooor is a symbol technology that places stability on AWS environments by modifying IAM parameters related to AWS roles and confidence restrictions.
The results show that even all errors of the frequent cloud environment can have catastrophic results for the institutions concerned, which leads to the theft of data and other subsequent attacks.
Yoann Dequeker & Arnaud Petitcol, researchers, Riskinsight, Report, Week
| “The attackers can continue without installing harmful programs or preparing warnings using techniques such as Accesskey injection, accuracy of confidence in the rear papers, and the use of nothingness policies.” “Aside from IAM, attackers can use AWS resources such as EC2 counterparts and LAMBDA functions to maintain access. Techniques reduce control and allow settlement or long -term destruction, include cloudtrail turning off, changing events determinants, implementing life cycle policies, and removing accounts from AWS organizations. |
About the author
Suraj Cole He is a content specialist in technical writing about cybersecurity and information security. He wrote many amazing articles on cybersecurity concepts, with the latest trends in electronic awareness and ethical piracy. Learn more about “him”.
Read more:
The best group of Russian infiltrators, while Gamardon & Turla is targeting Ukraine
About the author
Get the complete details at: https://www.news4hackers.com/critical-entra-id-flaw-enabling-global-admin-impersonation-across-tenants-patched-by-microsoft/
Stay updated with
—
**Additional Resources & Tags:**
– Author: daksh kataria
– Published on: 2025-09-22 18:30:00
– Tags: , Cyber Security,Admin Impersonation,Critical Entra ID,cybersecurity,Cybersecurity Flaws,Entra ID Flaw,Global Admin Impersonation,Identity Management,microsoft,Microsoft Patch,Tenant Security,Vulnerability
– Related Rules: [rule_{ruleNumber}], [rule_{ruleNumber}_plain]
**Visuals & Media:**
– Featured Image: https://www.news4hackers.com/wp-content/uploads/2025/09/entra-id-flow.webp
– Enclosure Link:
**URL & Links:**
– Post URL (slug): entra-critical-defect-that-enables-the-impersonation-of-the-global-supervisor-through-the-tenants-corrected-by-microsoft
– Encoded URL: https%3A%2F%2Fwww.news4hackers.com%2Fcritical-entra-id-flaw-enabling-global-admin-impersonation-across-tenants-patched-by-microsoft%2F
– Decoded URL: https://www.news4hackers.com/critical-entra-id-flaw-enabling-global-admin-impersonation-across-tenants-patched-by-microsoft/
– Redirect URL: https://www.news4hackers.com/critical-entra-id-flaw-enabling-global-admin-impersonation-across-tenants-patched-by-microsoft/
– Source Domain: www.news4hackers.com
**Meta & Miscellaneous:**
– Publication Time: 1758559638
– Hashtags: #Entra #Critical #defect #enables #impersonation #global #supervisor #tenants #corrected #Microsoft
– Custom Prompt/Note: Prompt
—
**Sample Post Title:** Entra Critical defect that enables the impersonation of the global supervisor through the tenants corrected by Microsoft –
