CVE-2026-35430 Overview
CVE-2026-35430 is an authorization bypass vulnerability in Microsoft Azure Privileged Identity Management (PIM). The flaw is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. An authenticated attacker can manipulate identifier values processed by Azure PIM to access resources or role activations belonging to other principals. Successful exploitation results in privilege escalation across the network, granting the attacker rights they were never assigned.
Critical Impact
Authenticated attackers can bypass PIM authorization checks to elevate privileges, gaining unauthorized access to high-value Azure roles and tenant resources.
Affected Products
- Microsoft Azure Privileged Identity Management (PIM)
- Azure tenants relying on PIM for just-in-time role activation
- Entra ID environments integrated with PIM role assignments
Discovery Timeline
- 2026-05-22 - CVE-2026-35430 published to the National Vulnerability Database
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-35430
Vulnerability Analysis
The vulnerability resides in how Azure PIM validates identifiers tied to role activation and assignment requests. PIM accepts a key or reference value that the requesting user can influence. The service then resolves that value to a privileged role or scope without re-validating that the caller owns the referenced entity. As a result, an authorized but low-privileged principal can substitute another user's or role's identifier and obtain access intended for that target. The flaw is network reachable and requires only low-privilege credentials. Confidentiality, integrity, and availability of affected tenants are all impacted because PIM governs the activation of high-tier roles such as Global Administrator and subscription Owner.
Root Cause
The root cause is reliance on a user-controlled key during authorization, mapped to [CWE-639]. PIM trusts a request parameter to identify the target object instead of binding the operation to the authenticated session's verified entitlements. Server-side checks fail to confirm that the caller is permitted to act on the referenced identifier, which allows cross-principal access.
Attack Vector
Exploitation occurs over the network against Azure management endpoints. The attacker authenticates with any valid Azure account that has minimal PIM-eligible permissions. They then craft API requests to PIM role assignment, activation, or eligibility endpoints with substituted object identifiers, role definition IDs, or scope references. PIM processes the request under the attacker's session but operates on the substituted target, producing an unauthorized state change. No user interaction is required, and the scope is unchanged because the operation runs within Azure's existing authorization boundary. The vulnerability is mechanically described in the Microsoft Security Update CVE-2026-35430 advisory; no public proof-of-concept code is available.
Detection Methods for CVE-2026-35430
Indicators of Compromise
- Unexpected Add member to role or Activate role events in Azure Audit Logs initiated by low-privileged accounts.
- PIM API calls referencing role definition IDs or principal object IDs that do not match the caller's prior assignment history.
- Sudden eligibility or active assignments to high-tier roles such as Global Administrator, Privileged Role Administrator, or subscription Owner.
- Bursts of failed authorization checks followed by a successful PIM state change from the same principal.
Detection Strategies
- Correlate Entra ID sign-in logs with PIM audit events to flag role activations performed by accounts that never previously requested those roles.
- Baseline normal PIM activation patterns per user and alert on deviations in role, scope, or justification metadata.
- Hunt for direct calls to the PIM Graph API (/roleManagement/directory/roleAssignmentScheduleRequests) issued from non-administrative sessions.
Monitoring Recommendations
- Stream AuditLogs, SignInLogs, and MicrosoftGraphActivityLogs from Entra ID into a centralized SIEM for cross-source correlation.
- Enable Microsoft Defender for Cloud Apps alerts for unusual administrative role activity and review PIM access reviews on a shortened cadence.
- Monitor for Microsoft service health and security advisory updates referencing CVE-2026-35430 to confirm tenant remediation status.
How to Mitigate CVE-2026-35430
Immediate Actions Required
- Review the Microsoft Security Update CVE-2026-35430 advisory and confirm tenant status, since the fix is delivered as a Microsoft service-side update.
- Audit all current PIM eligible and active assignments for high-privilege roles and revoke any unexpected entries.
- Enforce multi-factor authentication and Conditional Access policies for every PIM role activation request.
Patch Information
Microsoft addresses CVE-2026-35430 through a service-side update to Azure Privileged Identity Management. Customers do not need to deploy a binary patch, but should verify remediation status and audit historical PIM activity through the Microsoft Security Update CVE-2026-35430 advisory.
Workarounds
- Restrict PIM-eligible assignments to the minimum set of accounts and remove standing access where possible.
- Require approval workflows and justification for all sensitive role activations, reducing the value of any successful bypass.
- Enable Entra ID access reviews on privileged roles and shorten activation maximum duration to limit exposure windows.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
