May 2026: Azure Entra ID Spoofing Vulnerability
CVE-2026-40379 Published on May 12, 2026
Azure Entra ID Spoofing Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2026-40379 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2026-40379
stack.watch emails you whenever new vulnerabilities are published in Microsoft Azure Enterprise Security Token Service or Microsoft Entra Id. Just hit a watch button to start following.
Affected Versions
Microsoft Entra Version - is affected by CVE-2026-40379Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.