First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-55241

CriticalCVSS 10.0/10Last modified Oct 18, 2026

Description

Azure Entra ID Elevation of Privilege Vulnerability

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Entra	-

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241Vendor Advisory
https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/Technical Description, Third Party Advisory

Timeline

Published: Sep 4, 2025
Last modified: Oct 18, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-552427.5Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network.CVE-2025-552437.5Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over CVE-2025-552449.0Azure Bot Service Elevation of Privilege Vulnerability CVE-2025-552457.8Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally.CVE-2025-552477.3Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.CVE-2025-552485.7Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.CVE-2025-552495.3HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the applicati CVE-2025-55258.1A vulnerability was found in Jrohy trojan up to 2.15.3. It has been declared as critical. This vulnerability affects the function LogChan of CVE-2025-552505.3HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resul CVE-2025-552519.8HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthori CVE-2025-552529.8HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially CVE-2025-552544.8Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may all