The flaw stems from incorrect authorization in Microsoft Entra Connect Sync, which allows an authenticated user with existing access to elevate their privileges over a network. An attacker can gain higher-level permissions within the Entra Connect environment, potentially modifying identity data or configuration settings and undermining subsequent authentication and authorization flows.

The affected product is Microsoft Entra Connect. No specific vulnerable version information is provided. The guidance should be applied to all installations of Entra Connect that have not yet been patched to the latest release.

The CVSS score of 7.8 indicates a high severity risk, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation so far. The flaw results from faulty authorization controls; an attacker who already has authenticated access to Entra Connect Sync can elevate their privileges, likely through the networked management interface or API exposed by the sync component.