Get all your news in one place.
100's of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

This serious Microsoft Entra flaw could have let hackers infiltrate any user, so patch now

Microsoft Entra ID hero image.
  • Actor tokens allowed cross-tenant impersonation without logging or security checks
  • CVE-2025-55241 enabled Global Admin access via deprecated Azure AD Graph API
  • Microsoft patched the flaw in September 2025; actor tokens and Graph API are being phased out

Security researchers have found a critical vulnerability in Microsoft Entra ID which could have allowed threat actors to gain Global Administrator access to virtually anyone’s tenant - without being detected in any way.

Sign up to read this article
Read news from 100's of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.