The CVE identifies an access‑control flaw in Microsoft Entra ID that could allow an attacker to obtain privileges beyond those they should have. The brief description states that unauthorized elevation is possible. Based on the CWE‑285 labeling, it is inferred that the flaw could be exploited to perform actions that an authenticated user should not be able to carry out, potentially compromising confidentiality, integrity, or availability of the service.

Microsoft Entra ID is the affected product. No specific version ranges are listed in the CNA data; all deployments may need to verify against Microsoft’s update guide.

The CVSS score of 9.3 signals a high severity for remote exploitation, but EPSS indicates a very low probability of enterprise exploitation (<1%). The vulnerability is not currently listed in the CISA KEV catalog. It is inferred that the attack vector could be remote, but the CVE does not specify required conditions; the high score suggests that if exploited, the impact would be significant. Overall risk is tempered by the low EPSS but remains high per the severity metric.