Introduction
A maximum-severity SSRF vulnerability in Microsoft Entra ID Entitlement Management just earned a CVSS 10.0 score, yet the most notable part of this disclosure may be that customers do not need to do anything about it. Microsoft has already fixed CVE-2026-35431 entirely on the server side and published the CVE purely for transparency. That kind of disclosure is part of a newer approach to reporting vulnerabilities in cloud services.
Technical information
Root cause: server-side request forgery (CWE-918)
CVE-2026-35431 is a Server-Side Request Forgery vulnerability, classified under CWE-918. The flaw is in Microsoft Entra ID Entitlement Management, an identity governance feature that lets organizations manage identity and access lifecycles at scale. Entitlement Management uses "access packages" to bundle resources such as Microsoft Entra security groups, Microsoft 365 Groups, Teams, and SharePoint Online sites, so it sits at the center of many organizations' access governance workflows.
The SSRF vulnerability allows an unauthorized attacker to perform spoofing over a network. In practice, an attacker could induce the vulnerable server-side component to send requests to unintended destinations, and from there interact with internal services, exfiltrate data, or manipulate the integrity of responses.
CVSS 3.1 metric breakdown
The CVSS 3.1 vector that Microsoft assigned as the CNA describes the worst case:
| Metric | Value | Operational Implication |
|---|---|---|
| Base Score | 10.0 (Critical) | Maximum severity rating |
| Attack Vector (AV) | Network (N) | Exploitable remotely over the internet |
| Attack Complexity (AC) | Low (L) | No specialized access conditions required |
| Privileges Required (PR) | None (N) | No prior authentication needed |
| User Interaction (UI) | None (N) | Exploitable without any user participation |
| Scope (S) | Changed (C) | Impacts resources beyond the vulnerable component |
| Confidentiality (C) | High (H) | Total loss of confidentiality for impacted resources |
| Integrity (I) | High (H) | Total loss of integrity or complete loss of protection |
| Availability (A) | High (H) | Total loss of availability for the impacted component |
The "Changed" scope means a successful exploit could affect resources beyond the security boundary of the Entitlement Management component itself. For a cloud-hosted identity governance service, that could, in theory, mean lateral movement into adjacent infrastructure or tenant resources. The advisory does not say where the boundaries of the scope change lie.
What we do not know
No available advisory publicly details exploit payloads, proof-of-concept code, or the exact tenant-side conditions that trigger the SSRF. The National Vulnerability Database (NVD) has published the CVE but has not yet provided its own independent assessment. The missing specifics fit Microsoft's approach to cloud service CVEs. With the fix already deployed, detailed exploitation information would do little for defenders and could enable attacks against other, similar services.
Patch information
Microsoft has confirmed that CVE-2026-35431 is fully patched. The fix for the critical SSRF vulnerability in Microsoft Entra ID Entitlement Management was released on April 23, 2026.
Because Entra ID Entitlement Management is an exclusively cloud-hosted service, Microsoft applied the remediation entirely on the server side, which means no customer action is required. There is no downloadable update, no KB article, and no manual configuration change for administrators to make. Microsoft deployed the fix transparently through its internal cloud infrastructure update process.
The MSRC advisory states it directly: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take." Microsoft says it published the CVE solely for transparency. That follows the broader initiative described in its Toward greater transparency: Unveiling Cloud Service CVEs blog post, which is to publicly disclose vulnerabilities in cloud services even when customers have no remediation step to take.
The CVSS temporal vector records the fix as a Remediation Level of O (Official Fix), which means a complete vendor solution is in place. The base CVSS 3.1 score is 10.0, but the temporal score drops to 8.7 because the official fix is deployed and no public exploit code currently exists (E:U, Exploit Code Maturity: Unproven).
The Security Updates table on the MSRC page lists a single entry for Microsoft Entra ID with Customer Action Required: Not Required, one more confirmation that the remediation is complete and entirely Microsoft-managed.
Posture improvements worth considering
This CVE needs no specific remediation, but organizations should still use the disclosure to review their entitlement management configurations. In particular, make sure the policies governing access packages enforce appropriate multi-stage approvals and time-limited assignments, so identities do not keep access indefinitely.
Affected systems and versions
The vulnerability affects Microsoft Entra ID Entitlement Management, a cloud-hosted identity governance service. Because it is a fully managed cloud service, there are no software version numbers, on-premises builds, or downloadable components to list. Every instance of the service was affected, and Microsoft has remediated all of them on the server side.
