CVE-2026-24305 is a critical severity (CVSS 9.3) elevation of privilege vulnerability in Microsoft Entra ID. Microsoft's update guide data marks customer action as not required. Confirm that in the guide, review access to the service, and check your own audit logs.
What's affected
Microsoft titles this one Azure Entra ID Elevation of Privilege Vulnerability and gives no further technical detail. The CVSS base score is 9.3 and no privileges are required.
Microsoft's update guide data for this CVE reports it as not publicly disclosed and not exploited at the time of the latest revision (22 January 2026), and it flags no customer action as required. The affected component is a cloud service that Microsoft operates, so there is no version number for you to patch. Because Microsoft publishes no more detail than the title, do not guess at the mechanism.
How to check if you're exposed
There is nothing to scan for in your own code. Use the update guide entry as your record, and read it again for revisions:
curl -s https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-24305
The response includes the release date, the latest revision date and the customer action flag. Beyond that, review who holds roles and service principals in the affected service, and read your audit logs for anything unexpected around the disclosure date.
What to do now
- Open Microsoft's update guide entry for CVE-2026-24305 and confirm the customer action field.
- Note the latest revision date, and check again if it changes.
- Review role assignments and service principals in your tenant, and remove access nobody needs.
- Check audit logs for unexpected privilege changes and keep them for your records.
Why it matters
The weakness is CWE-285, improper authorization. A service decides what a caller may do, and the check can be missing, wrong or skippable. The CVSS scope is changed, which means the impact can reach beyond the vulnerable component into other resources.
When a cloud provider fixes a flaw in its own service, you usually cannot patch anything. What you can do is keep least privilege in place so that a future flaw of this type has less to reach. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Do I need to patch anything?
Microsoft's update guide data marks customer action required as false for this CVE. Confirm that on the guide page.
Is it exploited?
Microsoft's data lists it as not exploited, and it is not in CISA's Known Exploited Vulnerabilities catalog.
Sources
Last reviewed: 19 October 2026.
