Threat reportVulnerabilityTL-2026-1060
BeyondTrust Microsoft Vulnerabilities Report 2026: Critical Flaws More Than Double as Elevation of Privilege Dominates (CVE-2025-55241, CVE-2025-62557, CVE-2025-62554)
BeyondTrust Microsoft Vulnerabilities Report 2026 (TL-2026-1060), also tracked as BeyondTrust 2026 Microsoft Vulnerabilities Report, is a high-severity software vulnerability scored CVSS 10, first published 2026-07-02. It has no confirmed attribution, affects Microsoft Entra ID (Azure Active Directory), references 3 CVEs (CVE-2025-55241, CVE-2025-62557, CVE-2025-62554), maps to 23 MITRE ATT&CK techniques (T1068, T1069.003, T1078.004), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 10/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 23MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1060
- Threat ID
- TL-2026-1060
- Also known as
- BeyondTrust 2026 Microsoft Vulnerabilities Report, Actor Token Vulnerability, Entra ID Global Admin Impersonation Flaw
- Severity
- HIGH
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, education, manufacturing, critical-infrastructure, cross-industry-microsoft-tenants
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in BeyondTrust Microsoft Vulnerabilities Report 2026
Malware and tooling: ROADTools - S0684
How BeyondTrust Microsoft Vulnerabilities Report 2026 works
BeyondTrust's 13th annual Microsoft Vulnerabilities Report shows total Microsoft CVEs fell 6% YoY (1,360 to 1,273) while critical-severity vulnerabilities more than doubled (78 to 157, a 101% increase), with Azure/Dynamics 365 critical flaws up 9x (4 to 37) and Office critical flaws up ~10x. Elevation of Privilege remains the dominant category (509 CVEs, 40%), followed by Remote Code Execution (373 CVEs, 29%); the report is anchored by CVE-2025-55241, a CVSS 10.0 Entra ID Actor-token forgery flaw that allowed cross-tenant Global Administrator impersonation, and the CVE-2025-62557/62554 Office preview-pane memory-corruption RCE pair.
BeyondTrust published the 13th edition of its annual Microsoft Vulnerabilities Report on 2026-07-02, analyzing Microsoft's full-year 2025 CVE disclosures. While the raw count of Microsoft vulnerabilities declined 6% year-over-year (1,360 in 2024 to 1,273 in 2025), the report's central finding is that risk did not decrease -- it concentrated. Critical-severity vulnerabilities more than doubled, rising 101% from 78 to 157. Under the newer CVSS v4 scoring methodology, critical-rated flaws also rose from 39 to 42. The concentration of risk is most acute in cloud and productivity surfaces: Microsoft Azure and Dynamics 365 saw critical vulnerabilities increase 9x, from 4 in 2024 to 37 in 2025, and Microsoft Office's critical vulnerability count rose roughly 10x, from 3 in 2024 to 31 in 2025 (with total Office CVEs more than tripling from 47 to 157). Windows and Windows Server remain the largest raw-volume products (612 and 780 CVEs respectively, with 36 and 50 rated critical), while Microsoft Edge fell 83% year-over-year to 50 CVEs and zero rated critical. By vulnerability category, Elevation of Privilege (EoP) is the dominant class for the fourth consecutive year, accounting for 509 CVEs (40% of all disclosures), followed by Remote Code Execution at 373 CVEs (29%) and Information Disclosure at 175 CVEs (up 73% from 101 in 2024). BeyondTrust's analysis, quoting security researcher Sami Laiho ('The true risk in modern environments isn't the presence of vulnerabilities -- it's the presence of unnecessary privilege'), frames the trend as validation that privilege -- not raw bug count -- is now the primary attack surface in Microsoft environments. The report is illustrated by two headline 2025 vulnerabilities that exemplify the EoP and RCE trend lines documented in the aggregate data. CVE-2025-55241 is a CVSS 10.0 (Microsoft CNA scoring; NVD scores 9.8) Elevation of Privilege vulnerability in Microsoft Entra ID (CWE-287, Improper Authentication), discovered by independent researcher Dirk-Jan Mollema and reported to MSRC on 2025-07-14. The flaw exploited an undocumented 'Actor token' mechanism used for internal Microsoft service-to-service communication: Actor tokens are valid for 24 hours, are not logged when issued or used, cannot be revoked, and bypass Conditional Access policies entirely. These tokens are wrapped in an unsigned impersonation JWT, and the legacy Azure AD Graph API (graph.windows.net) failed to validate that the impersonation JWT's tenant-ID claim matched the tenant actually being queried. An attacker able to obtain an Actor token from any tenant (including a self-owned trial tenant) could therefore forge an impersonation token naming an arbitrary target tenant ID and an arbitrary internal user identifier (netId), and the target tenant's Azure AD Graph API would accept it -- effectively allowing impersonation of any identity in any Entra ID tenant, including Global Administrators, with no authentication challenge, no MFA prompt, and no audit trail for read operations. Attackers could obtain valid netId values via incremental brute-forcing, extraction from previously leaked/expired tokens, or via B2B guest-user attributes exposed through cross-tenant trust relationships -- meaning any organization that accepted an external guest invitation became a potential pivot point into unrelated tenants, including theoretically Microsoft's own corporate tenant. Microsoft deployed a global production fix on 2025-07-17 (three days after report) and a secondary mitigation on 2025-08-06 blocking Actor-token issuance via Service Principal credentials for the Azure AD Graph endpoint; the CVE was formally published 2025-09-04. No customer action was required and no in-the-wild exploitation was confirmed prior to the fix, though CISA has since flagged the CVE as having public proof-of-concept / technical exploitation detail available (Mollema's writeup includes attack methodology sufficient to reconstruct the technique). CVE-2025-62557 (CWE-416, Use-After-Free) and CVE-2025-62554 (CWE-843, Type Confusion) are a related pair of Microsoft Office memory-corruption vulnerabilities disclosed in Microsoft's December 2025 Patch Tuesday, each rated 8.4 (Microsoft CNA) / 7.8 (NVD) CVSS v3.1, AV:L/AC:L/PR:L/UI:N -- critically, both are reachable via the Outlook/Explorer Preview Pane, meaning a victim does not need to open, click, or interact with a malicious file; simply previewing a specially crafted Office document (e.g. an email attachment rendered in the reading pane) is sufficient to trigger memory corruption and achieve remote code execution in the context of the logged-on user. CVE-2025-62554 is a type-confusion flaw in Office's object-handling logic where a resource is accessed using an incompatible type, while CVE-2025-62557 is a classic use-after-free in Office's document-parsing engine. Both affect Microsoft 365 Apps for Enterprise, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Office for Android. Microsoft's guidance for organizations unable to patch immediately is to disable the Outlook/Explorer Preview Pane and thumbnail generation and to enforce Protected View for internet-sourced files. Collectively, these three CVEs -- one maximum-severity cross-tenant identity-impersonation flaw and one zero-click document-preview RCE pair -- serve as concrete illustrations of the report's macro finding: Microsoft's vulnerability surface is shifting away from broad, low-severity bug volume and toward fewer, more severe flaws concentrated in identity/privilege (EoP) and code-execution (RCE) categories across cloud (Entra ID, Azure/Dynamics 365) and productivity (Office) surfaces.
MITRE ATT&CK techniques used in TL-2026-1060
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078.004 Cloud Accounts; T1548 Abuse Elevation Control Mechanism
Discovery
T1069.003 Cloud Groups; T1087.004 Cloud Account; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Defense Evasion
Persistence
T1098.003 Additional Cloud Roles
Command and Control
Credential Access
T1110.004 Credential Stuffing; T1528 Steal Application Access Token; T1552 Unsecured Credentials
Collection
T1119 Automated Collection; T1213 Data from Information Repositories
Initial Access
T1199 Trusted Relationship; T1566 Phishing
Execution
T1203 Exploitation for Client Execution
Impact
T1531 Account Access Removal; T1565 Data Manipulation
Lateral Movement
T1550.001 Application Access Token
defense-impairment
T1556.006 Multi-Factor Authentication; T1685.002 Disable or Modify Cloud Log
credential-access
Affected products and versions in BeyondTrust Microsoft Vulnerabilities Report 2026
- Microsoft — Entra ID (Azure Active Directory)
Vulnerable versions: all tenants prior to 2025-07-17 backend fix
Fixed in: server-side fix deployed globally 2025-07-17; no customer action required - Microsoft — Azure AD Graph API (graph.windows.net)
Vulnerable versions: legacy service, all versions prior to fix
Fixed in: Service Principal Actor-token issuance blocked 2025-08-06 - Microsoft — Microsoft 365 Apps for Enterprise
Vulnerable versions: 16.0.1 and later, pre-December 2025 update
Fixed in: December 2025 Patch Tuesday cumulative update - Microsoft — Microsoft Office 2016
Vulnerable versions: 16.0.0 to 16.0.5530.1001
Fixed in: December 2025 security update - Microsoft — Microsoft Office 2019
Vulnerable versions: 19.0.0 and later, pre-December 2025 update
Fixed in: December 2025 security update - Microsoft — Microsoft Office LTSC 2021 / 2024 (Windows and Mac)
Vulnerable versions: pre-December 2025 update
Fixed in: December 2025 security update - Microsoft — Microsoft Office for Android
Vulnerable versions: 16.0.1 to 16.0.19530.20000
Fixed in: December 2025 security update - Microsoft — Windows / Windows Server (2025 aggregate)
Vulnerable versions: 612 Windows CVEs / 780 Windows Server CVEs disclosed in 2025 (36 / 50 rated critical)
Fixed in: per-CVE monthly cumulative updates - Microsoft — Azure / Dynamics 365 (2025 aggregate)
Vulnerable versions: 37 critical CVEs disclosed in 2025, up from 4 in 2024
Fixed in: per-CVE cloud-side and product updates
Remediation for BeyondTrust Microsoft Vulnerabilities Report 2026
Patches
- CVE-2025-55241: fixed server-side by Microsoft globally on 2025-07-17; secondary mitigation blocking Service-Principal-issued Actor tokens deployed 2025-08-06; no customer patch required
- CVE-2025-62554 and CVE-2025-62557: Microsoft December 2025 Patch Tuesday cumulative updates for Microsoft 365 Apps for Enterprise, Office 2016/2019, Office LTSC 2021/2024, and Office for Android
Immediate actions
- Confirm Entra ID tenant received Microsoft's server-side fix for CVE-2025-55241 (no customer action required; verify via MSRC advisory reference)
- Disable Outlook and Windows Explorer Preview Pane and thumbnail generation for users/servers not yet patched against CVE-2025-62557 and CVE-2025-62554
- Enforce Protected View for all Office files originating from the internet or untrusted locations
- Apply Microsoft's December 2025 Patch Tuesday cumulative updates covering CVE-2025-62557 and CVE-2025-62554
- Audit Entra ID sign-in and audit logs for mismatched InitiatedBy display-name/UPN pairs (e.g. UPN of a Global Admin paired with display name 'Office 365 Exchange Online', 'Skype for Business Online', or 'Dataverse')
Workarounds
- Disable Preview Pane / Reading Pane in Outlook and Windows Explorer to mitigate zero-click Office RCE exposure pending patch deployment
- Restrict or monitor B2B guest invitations to reduce cross-tenant identity-enumeration exposure
Longer-term hardening
- Inventory and prioritize patching for Elevation of Privilege CVEs, which represent 40% of all 2025 Microsoft disclosures and the largest attack-surface growth area
- Treat Azure/Dynamics 365 and Office critical-vulnerability growth (9x and ~10x YoY) as a signal to accelerate cloud and M365 patch cadence relative to on-prem Windows
- Adopt least-privilege / Just-In-Time administration for Global Administrator and other high-privilege Entra ID roles to reduce blast radius of any future token-forgery-class flaw
- Review and restrict B2B guest-user trust relationships, since guest attributes were shown to leak internal identifiers usable in cross-tenant impersonation attacks
- Deprecate and disable legacy Azure AD Graph API (graph.windows.net) access where feasible in favor of Microsoft Graph, which has stronger tenant-boundary validation
CVEs associated with BeyondTrust Microsoft Vulnerabilities Report 2026
Weaknesses (CWE) in BeyondTrust Microsoft Vulnerabilities Report 2026
Timeline of BeyondTrust Microsoft Vulnerabilities Report 2026
- Security researcher Dirk-Jan Mollema reports the Entra ID Actor-token cross-tenant impersonation flaw to the Microsoft Security Response Center (MSRC).
- Microsoft deploys a global production-side fix for the Azure AD Graph API tenant-validation flaw underlying CVE-2025-55241; no customer action required.
- Microsoft deploys a secondary mitigation blocking Actor-token issuance via Service Principal credentials for the legacy Azure AD Graph endpoint.
- CVE-2025-55241 (CVSS 10.0, Entra ID Elevation of Privilege) formally published by Microsoft and NVD.
- Dirk-Jan Mollema publishes full technical write-up 'Obtaining Global Admin in Every Entra ID Tenant with Actor Tokens', including attack methodology, KQL detection query, and MITRE mapping.
- Microsoft's December 2025 Patch Tuesday discloses and patches CVE-2025-62554 (type confusion) and CVE-2025-62557 (use-after-free), both Office RCE vulnerabilities reachable via the Outlook/Explorer Preview Pane with no user interaction required.
- BeyondTrust publishes the 13th annual Microsoft Vulnerabilities Report, documenting full-year 2025 Microsoft CVE trends including the 101% YoY increase in critical vulnerabilities.
- NVD record for CVE-2025-55241 last modified, reflecting CISA's flag that public proof-of-concept / exploitation detail is available via the published research.
- Cyber Security News publishes analysis of the BeyondTrust 2026 report, driving the current threat-intel hunt cycle for TL-2026-1060.
Sources cited for BeyondTrust Microsoft Vulnerabilities Report 2026
- Critical Flaws Double as Elevation of Privilege Dominates the Cyber Threats – Analysis of Microsoft Vulnerabilities Report 2026
- 2026 Microsoft Vulnerabilities Report | 13th Edition | BeyondTrust
- BeyondTrust's 13th Annual Microsoft Vulnerabilities Report Reveals Drop in Total Volume, But Surge in Critical Risk
- Critical Microsoft Vulnerabilities Doubled: From Exposure to Escalation
- Microsoft Vulnerabilities Drop, But Critical Flaws Double, Report Warns
- CVE-2025-55241 Detail - NVD
- Microsoft Security Response Center: CVE-2025-55241
- Obtaining Global Admin in Every Entra ID Tenant via Actor Tokens
- Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants
- Critical Entra ID Vulnerability CVE-2025-55241: Microsoft Issues Emergency Fix for Cross-Tenant Token Exploit
- Death by Token: Understanding CVE-2025-55241
- CVE-2025-55241: Critical Cross-Tenant Privilege Escalation in Microsoft Entra ID
- CVE-2025-62554 Detail - NVD
- Microsoft Security Response Center: CVE-2025-62554
- Microsoft Security Response Center: CVE-2025-62557
Detection coverage for TL-2026-1060
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1060 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.