Critical SSRF in Microsoft Entra ID Entitlement Management

The National Vulnerability Database has disclosed CVE-2026-35431, a critical server-side request forgery (SSRF) vulnerability in Microsoft Entra ID Entitlement Management. This flaw, carrying a maximum CVSS score of 10.0, allows an unauthorized attacker to perform spoofing over a network. The implications are severe, as SSRF can often be leveraged to access internal systems, enumerate services, or even execute arbitrary commands on backend infrastructure.

This isn’t just a theoretical bug; an SSRF of this magnitude in a core identity management service means attackers can bypass perimeter defenses and directly interact with sensitive internal resources. Identity services are prime targets, and a critical SSRF here is a direct path to privilege escalation and data exfiltration. The fact that it’s unauthenticated further lowers the bar for attackers.

While specific affected products beyond ‘Microsoft Entra ID Entitlement Management’ are not detailed by the National Vulnerability Database, organizations relying on this service must assume exposure. The attacker’s calculus here is simple: find an Entra ID Entitlement Management instance, exploit the SSRF to gain internal network access, and then pivot to high-value targets. This is a direct shot at the heart of an organization’s access control.