Microsoft has warned that a maximum-severity flaw in Entra ID is under attack, and says the cloud identity bug is already fixed without disclosing who exploited it or how widely.
Microsoft has sounded the alarm over a maximum-severity vulnerability in Entra ID that is already under active attack. The company says the cloud identity bug has been fixed, but has not disclosed who exploited it or how widely it has been used.
The flaw carries a perfect-10 severity score, indicating the highest level of risk. Microsoft has not provided further details about the attack or the timeline of exploitation.
Why this matters: The active exploitation of a maximum-severity identity flaw highlights the risk to organisations using Entra ID for cloud access.
What this means for you: Organisations using Entra ID should ensure they have applied Microsoft's fix to protect against potential attacks.
Join thousands of readers getting the best of British news straight to their inbox.