CVE-2026-57100: Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

Synopsis

A server-side request forgery (SSRF) vulnerability exists in Microsoft Entra Provisioning Service (SyncFabric). An attacker with a low-privilege account can reach the service over the network and, without any victim interaction, trick the server into issuing requests on their behalf to escalate privileges across scope boundaries. Successful exploitation grants full read, write, and availability impact on affected resources, including components outside the vulnerable service itself. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Microsoft publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SyncFabric service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is needed but the service must be exposed to the attacker's network path.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account; the CVSS vector specifies PR:L, so any authenticated user, not just an admin, is sufficient to attempt exploitation.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the CVSS vector specifies UI:N, meaning the attacker can trigger the SSRF entirely through their own requests.

• Attack complexityDetail

  The CVSS vector specifies AC:L, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors that the attacker cannot control.

Blast Radius

• A successful attacker causes the Entra Provisioning Service to issue arbitrary internal HTTP requests, potentially reaching internal APIs, metadata endpoints, or downstream identity infrastructure that are not directly exposed externally.
• The attacker reads sensitive data accessible to the service identity, including credentials, tokens, or provisioning configuration stored in reachable internal systems (CVSS C:H).
• The attacker modifies provisioning data or internal resource state, including user account attributes or group memberships managed by SyncFabric (CVSS I:H).
• The attacker disrupts availability of the provisioning service or dependent systems it can reach, causing provisioning failures or service outages (CVSS A:H). The changed scope (S:C) means impact extends beyond the vulnerable component itself.