CVE-2026-45480: Azure Active Directory Elevation of Privilege Vulnerability

Synopsis

An improper authentication vulnerability in Azure Active Directory allows an unauthenticated attacker to reach the service over the network and elevate privileges without any user interaction. Exploitation gives the attacker full control over confidentiality, integrity, and availability across the affected scope, which extends beyond the vulnerable component itself. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Azure Active Directory service over the network; no physical or local access is needed.

• AuthenticationNot required

  No credentials or account of any privilege level are required to begin the attack.

• Victim interactionNot required

  The exploit completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors must be arranged.

Blast Radius

• Reads any data accessible within the affected scope, including authentication tokens, directory objects, and identity records.
• Modifies directory data, group memberships, role assignments, and access policies across the tenancy.
• Disrupts authentication and authorization services, blocking legitimate user and application access.
• Because the scope is changed (S:C), impact extends beyond the directly vulnerable component to dependent services and applications that rely on Azure Active Directory for identity.