Microsoft Entra ID Entitlement Management contains a server‑side request forgery flaw that permits an unauthorized attacker to direct the service to send requests to arbitrary internal endpoints. Based on the description, it is inferred that this could be used to spoof network traffic, causing the Entra ID server to invoke services or endpoints within the internal network without user interaction. The vulnerability is limited to the Entitlement Management functionality and requires no authentication to exploit.

Microsoft Entra ID, specifically the Entitlement Management component. Because the advisory does not list particular build numbers or patch releases, all deployments using Entra ID are potentially impacted until Microsoft issues a fix. Administrators should verify the version they are operating but note that version specifics were not disclosed.

The CVSS score of 10.0 marks this as a critical vulnerability that can be exploited by an unauthorized attacker. The EPSS score of less than 1% indicates a low current exploitation probability, and it is not catalogued in CISA’s KEV list. Attackers can exploit the flaw by sending a crafted request to the Entitlement Management API, causing the Entra service to connect to arbitrary URLs on the internal network. No user interaction or authentication is required to bring the vulnerability to fruition.