Loading story…
A severe vulnerability in Microsoft's Entra ID (formerly Azure AD) allowed attackers to use Actor Tokens from their own tenant to gain global admin privileges in any other tenant. The flaw, tracked as CVE-2025-55241, was found in the legacy Azure AD Graph API, which failed to properly validate the originating tenant. Microsoft rapidly deployed a global fix after responsible disclosure and found no evidence of exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
14 references tracked. Mallory keeps watching after this page renders.
blog.nviso.eu
Open sourcescworld.com
Open sourcehackread.com
Open sourcethehackernews.com
Open sourcewired.com
Open sourcecloudvulndb.org
Open sourcedirkjanm.io
Open sourcecloudbrothers.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researcher Dirk-Jan Mollema disclosed CVE-2025-55241, a flaw in Microsoft Entra ID (Azure AD) that allowed a single token to grant administrative access to every tenant worldwide. The vulnerability stemmed from improper validation of 'Actor tokens,' enabling attackers to bypass all security controls and remain undetected. This incident highlights the systemic risk of centralized authority in identity platforms and calls for distributed, authorityless security architectures.
Jun 29, 2026
Microsoft fixed a privilege escalation flaw in **Entra ID** that allowed users with the built-in **Agent ID Administrator** role to take over arbitrary service principals, including identities unrelated to AI agents. Silverfort reported that the role could assign ownership over a target service principal, add new credentials, and then authenticate as that principal, effectively enabling full service principal takeover. The weakness stemmed from a scoping gap in Microsoft’s Agent Identity Platform, where a role intended to manage agent-related objects could also affect standard directory components. The exposure was especially serious in tenants with highly privileged service principals, where attackers could inherit sensitive API access, integrations, or directory-level roles and potentially reach **Global Administrator-equivalent** power. Silverfort said the abuse path was broadly relevant because most customer tenants it analyzed had at least one privileged service principal, while ownership changes could blend in with normal administrative activity and evade detection. Microsoft addressed the issue with a backend fix that restricted the **Agent ID Administrator** role to agent-related objects and said the remediation was fully rolled out by April 9.
Jun 29, 2026
Researchers at Enclave disclosed a critical improper authentication flaw in Microsoft's Azure SRE Agent that allowed an outsider with only a free Azure account to observe another organization's AI operations agent in real time. The cross-tenant exposure stemmed from a token issuance process that accepted accounts from any Microsoft cloud tenant and a communication channel that verified token validity but not tenant ownership, enabling unauthorized access to live agent sessions. Microsoft confirmed the issue, assigned `CVE-2026-32173`, rated it critical with a `CVSS` score of `8.6`, and remediated it server-side. According to the disclosure, exposed data could include user prompts, agent responses, step-by-step reasoning, executed commands, command output, and even plaintext credentials, while generating no logs visible to the victim organization, underscoring wider concerns that enterprise AI agent deployments are outpacing governance and security controls.
Jun 29, 2026