CVE-2026-40379: Azure Entra ID Information Disclosure Bug

CVE-2026-40379 Overview

CVE-2026-40379 is an information disclosure vulnerability in Microsoft Azure Entra ID. The flaw exposes sensitive information to an unauthorized actor and enables an attacker to perform spoofing across a network. The weakness is categorized as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Exploitation requires user interaction and changes the security scope, which permits an attacker to impact resources beyond the originally vulnerable component. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.

Critical Impact

An unauthorized network attacker can obtain sensitive identity data from Azure Entra ID and use it to spoof legitimate principals, undermining authentication trust across federated cloud and SaaS resources.

Affected Products

• Microsoft Azure Entra ID (cloud identity service)
• Workloads and applications federated with affected Entra ID tenants
• Downstream Microsoft 365 and Azure resources relying on Entra ID authentication

Discovery Timeline

• 2026-05-12 - CVE-2026-40379 published to the National Vulnerability Database (NVD)
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-40379

Vulnerability Analysis

The vulnerability resides in Azure Entra ID, Microsoft's cloud-based identity and access management service. According to Microsoft's advisory, sensitive information is exposed to an unauthorized actor, and that exposure enables spoofing over a network.

The CWE-200 classification indicates the root issue is the unintended disclosure of data to a party that should not have access. In an identity service, such data can include tokens, identifiers, or metadata that anchor trust decisions. An attacker who obtains this information can impersonate legitimate users or services when interacting with applications that trust Entra ID assertions.

The attack requires user interaction, such as a victim clicking a crafted link or loading attacker-controlled content. The scope change in the advisory indicates that successful exploitation affects components beyond the directly vulnerable service, including federated relying parties.

Root Cause

The root cause is improper restriction of sensitive identity information returned or processed by Azure Entra ID. The service discloses data that should remain confidential, allowing an attacker to derive material needed to spoof an identity. Microsoft has not published low-level technical details beyond the advisory.

Attack Vector

The attack vector is network-based. An unauthenticated attacker triggers the flaw by inducing a victim to interact with attacker-controlled content. The leaked information is then used to forge or replay authentication artifacts against applications relying on Entra ID. No prior privileges are required on the target tenant.

No public proof-of-concept exploit is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft CVE-2026-40379 Update Guide for vendor-provided technical context.

Detection Methods for CVE-2026-40379

Indicators of Compromise

• Unexpected sign-ins from unfamiliar IP addresses, autonomous systems, or geographies for high-value Entra ID principals
• Token issuance or refresh events that do not correlate with a preceding user authentication event
• Application consent grants or OAuth token redemptions originating from unknown client applications
• Anomalous use of legacy authentication endpoints or non-interactive sign-ins for accounts that normally use interactive flows

Detection Strategies

• Correlate Entra ID sign-in logs, audit logs, and risk detections to identify impossible travel, atypical user agents, and token replay patterns
• Hunt for sign-ins where the conditional access result, device compliance state, or session ID is inconsistent with the user's baseline
• Monitor application and service principal activity for new credentials, redirect URI changes, or unusual API calls against Microsoft Graph

Monitoring Recommendations

• Forward Entra ID sign-in, audit, and risk event logs to a centralized SIEM or data lake for long-retention analysis
• Enable Microsoft Entra ID Protection risk policies and review medium and high risk detections daily
• Alert on changes to privileged role assignments, federation settings, and tenant-level authentication policies

How to Mitigate CVE-2026-40379

Immediate Actions Required

• Review the Microsoft CVE-2026-40379 Update Guide and apply any tenant-level mitigations or configuration changes Microsoft recommends
• Revoke active refresh tokens for privileged accounts and force re-authentication using Revoke-AzureADUserAllRefreshToken or the Microsoft Graph revokeSignInSessions API
• Audit Entra ID application registrations, service principals, and consent grants for unauthorized changes
• Enforce phishing-resistant multi-factor authentication for administrative and high-value accounts

Patch Information

Microsoft addresses Azure Entra ID vulnerabilities through service-side updates that are applied automatically to the cloud platform. No customer-installable patch is required for the Entra ID service itself. Customers should verify guidance in the MSRC advisory for any required tenant configuration changes or client library updates.

Workarounds

• Enforce conditional access policies that require compliant devices and trusted network locations for sensitive applications
• Disable legacy authentication protocols that bypass modern conditional access controls
• Restrict user consent for applications and require admin consent for permissions that access directory data
• Apply continuous access evaluation (CAE) so revoked sessions terminate near real time across Microsoft 365 services

# Example: revoke all refresh tokens for a user via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.RevokeSessions.All"
Revoke-MgUserSignInSession -UserId "user@contoso.com"

# Example: block legacy authentication via Conditional Access policy (PowerShell)
# Set the policy state to 'enabled' after validating impact in report-only mode
New-MgIdentityConditionalAccessPolicy -DisplayName "Block Legacy Auth" `
    -State "enabledForReportingButNotEnforced"