Microsoft patches exploited Entra ID zero-day

Microsoft has addressed a maximum-severity security vulnerability in Entra ID, its cloud-based identity and access management platform. The company confirmed that the flaw had been exploited in targeted attacks prior to the patch’s release.

What happened

The vulnerability, tracked internally by Microsoft, was classified as critical due to its potential to allow unauthenticated access to protected resources. Entra ID, formerly known as Azure Active Directory, is widely used by enterprises to manage user identities and access to cloud and on-premises applications. Microsoft did not disclose the number of affected customers or the specific industries targeted in the attacks.

The patch was deployed automatically to all Entra ID tenants, with no customer action required for most configurations. Microsoft’s security advisory noted that the exploit could be leveraged without user interaction, increasing the risk of widespread compromise.

What we don’t know yet

Details about the attack vectors, the identities of the threat actors, and the duration of the exploitation remain undisclosed. Microsoft has not indicated whether the flaw was discovered internally or reported by an external researcher. The company’s advisory did not specify if any data breaches resulted from the attacks, leaving customers uncertain about potential exposure.