Kevin BeaumontSep 17, 2025

Dirk-jan Mollema, who discovered Zerologon (the most impactful on prem Active Directory vulnerability ever), has discovered an Azure Active Directory (EntraID) vulnerability which allowed anybody to take over any tenant - access any Microsoft 365 resource, basically. CVE-2025-55241

https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

Edit: Tom Tervoort discovered ZeroLogon and Dirk-jan expanded upon it.

One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens

While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments). If you are an Entra ID admin reading this, yes that means complete access to your tenant. The vulnerability consisted of two components: undocumented impersonation tokens that Microsoft uses in their backend for service-to-service (S2S) communication, called “Actor tokens”, and a critical vulnerability in the (legacy) Azure AD Graph API that did not properly validate the originating tenant, allowing these tokens to be used for cross-tenant access.

dirkjanm.io
golemSep 17, 2025
Show threadKevin Beaumont
My favourite thing about this one is the cross tenant bit generated no logs in the victim's tenant.. so good luck with that. MS assigned a CVE, said no customer action needed, and then didn't tell anybody about the details.
Sep 17, 2025 at 6:04pmWeb
Show threadKevin BeaumontSep 17, 2025

Prior from Dirk-jan Mollema was ZeroLogon, a fun vuln which allowed anybody to reset a domain controller password.

https://doublepulsar.com/in-the-wild-exploitation-of-zerologon-detected-over-the-internet-on-honeypot-f61e2700215b

In the wild exploitation of ZeroLogon detected over the internet on honeypot.

So the title there is exactly as it reads — a few weeks ago I set up a honeypot vulnerable to CVE-2020–1472 aka ZeroLogon.

Medium
Show threadJoshua SmallSep 17, 2025
@GossiTheDog I like how you talk about this in the past tense as though I don't use it on pentests today.
Show threadMartin SeegerSep 17, 2025
@GossiTheDog No logs, no conditional access restriction. Any intelligence agency’s dream …
Show threadTanawtsSep 17, 2025

@GossiTheDog sigh

Yup... if the cloud fixes it and the customer doesnt have to take action for a fix, then it's mostly silent.

Due diligence review of potential post-breach unauthorized access is completely excluded

CVE is obsolete in cloud service paradigm

:/

Show threadrx13  Sep 17, 2025
@GossiTheDog
... just like AWS logs then 😂 (though they do log to destination tenant, just not origin tenant)