Dirkjan

**Name of the Vulnerable Software and Affected Versions** Microsoft Entra ID (affected versions not specified) **Description** A critical flaw in the authentication procedure of Microsoft Entra ID (formerly Azure Active Directory) allowed remote attackers to elevate privileges and impersonate any user, including Global Administrators, across all tenants globally. The issue stemmed from a combination of undocumented "Actor tokens"—internal tokens used for service-to-service communication—and a validation error in the legacy Azure AD Graph API. Specifically, the API failed to perform proper boundary checks on the originating tenant, allowing a token from one tenant to be used to access others. Because these tokens were unsigned and bypassed security policies like Conditional Access, exploitation could occur without triggering alarms or leaving actionable logs. This could lead to full infrastructure control, including the ability to read user profiles, extract BitLocker recovery keys, and create new Global Administrator accounts. **Recommendations** Audit all Global Administrator accounts created during the vulnerability period. Rotate all critical keys and certificates. Analyze access logs for suspicious activity. As a temporary mitigation, restrict access to the legacy Azure AD Graph API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Exchange Server versions prior to the April 2025 Hot Fix **Description** A high-severity vulnerability (CVE-2025-53786) exists in Microsoft Exchange Server hybrid deployments. This vulnerability allows attackers with administrative access to on-premises Exchange servers to escalate privileges and potentially compromise cloud environments. The vulnerability stems from a shared service principal used between on-premises and Exchange Online, enabling attackers to forge trusted tokens for cloud access without generating logs. Over 29,000 Exchange servers were reported as unpatched and vulnerable. CISA issued an emergency directive mandating federal agencies to patch the vulnerability by August 11, 2025. Exploitation is considered likely. **Recommendations** Apply the April 2025 Hot Fix or later to all affected Exchange Server deployments. Implement the changes outlined in the Microsoft security guidance released on April 18, 2025. For hybrid deployments, reconfigure the hybrid application to avoid using the shared service principal. Reset service principal credentials. Run the Exchange Health Checker to verify the configuration.

Name of the Vulnerable Software and Affected Versions: Windows Active Directory integrated DNS (ADIDNS) (affected versions not specified) Description: A remote code execution issue exists due to Active Directory integrated DNS (ADIDNS) mishandling objects in memory. An authenticated attacker could exploit this by sending malicious requests to an ADIDNS server, potentially allowing them to run arbitrary code in the context of the Local System Account. The issue is related to a buffer overflow in memory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Active Directory integrated DNS (ADIDNS) (affected versions not specified) Description: A remote code execution issue exists due to Active Directory integrated DNS (ADIDNS) mishandling objects in memory. An authenticated attacker could exploit this by sending malicious requests to an ADIDNS server, potentially allowing them to run arbitrary code in the context of the Local System Account. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Active Directory (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in Active Directory Forest trusts. This vulnerability is due to a default setting that allows an attacker in the trusting forest to request delegation of a TGT for an identity from the trusted forest. The vulnerability can be exploited by a remote attacker to elevate their privileges. Technical details include the bypassing of the SID filtering mechanism, which can lead to the compromise of hosts in transitively trusted forests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.