# BeyondTrust Microsoft Vulnerabilities Report 2026: Critical Flaws More Than Double as Elevation of Privilege Dominates (CVE-2025-55241, CVE-2025-62557, CVE-2025-62554)

> BeyondTrust's 13th annual Microsoft Vulnerabilities Report shows total Microsoft CVEs fell 6% YoY (1,360 to 1,273) while critical-severity vulnerabilities more than doubled (78 to 157, a 101% increase), with Azure/Dynamics 365 critical flaws up 9x (4 to 37) and Office critical flaws up ~10x. Elevation of Privilege remains the dominant category (509 CVEs, 40%), followed by Remote Code Execution (373 CVEs, 29%); the report is anchored by CVE-2025-55241, a CVSS 10.0 Entra ID Actor-token forgery flaw that allowed cross-tenant Global Administrator impersonation, and the CVE-2025-62557/62554 Office preview-pane memory-corruption RCE pair.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1060
- **ID:** TL-2026-1060
- **Severity:** HIGH (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55241, CVE-2025-62557, CVE-2025-62554

## Description

BeyondTrust published the 13th edition of its annual Microsoft Vulnerabilities Report on 2026-07-02, analyzing Microsoft's full-year 2025 CVE disclosures. While the raw count of Microsoft vulnerabilities declined 6% year-over-year (1,360 in 2024 to 1,273 in 2025), the report's central finding is that risk did not decrease -- it concentrated. Critical-severity vulnerabilities more than doubled, rising 101% from 78 to 157. Under the newer CVSS v4 scoring methodology, critical-rated flaws also rose from 39 to 42. The concentration of risk is most acute in cloud and productivity surfaces: Microsoft Azure and Dynamics 365 saw critical vulnerabilities increase 9x, from 4 in 2024 to 37 in 2025, and Microsoft Office's critical vulnerability count rose roughly 10x, from 3 in 2024 to 31 in 2025 (with total Office CVEs more than tripling from 47 to 157). Windows and Windows Server remain the largest raw-volume products (612 and 780 CVEs respectively, with 36 and 50 rated critical), while Microsoft Edge fell 83% year-over-year to 50 CVEs and zero rated critical. By vulnerability category, Elevation of Privilege (EoP) is the dominant class for the fourth consecutive year, accounting for 509 CVEs (40% of all disclosures), followed by Remote Code Execution at 373 CVEs (29%) and Information Disclosure at 175 CVEs (up 73% from 101 in 2024). BeyondTrust's analysis, quoting security researcher Sami Laiho ('The true risk in modern environments isn't the presence of vulnerabilities -- it's the presence of unnecessary privilege'), frames the trend as validation that privilege -- not raw bug count -- is now the primary attack surface in Microsoft environments. The report is illustrated by two headline 2025 vulnerabilities that exemplify the EoP and RCE trend lines documented in the aggregate data. CVE-2025-55241 is a CVSS 10.0 (Microsoft CNA scoring; NVD scores 9.8) Elevation of Privilege vulnerability in Microsoft Entra ID (CWE-287, Improper Authentication), discovered by independent researcher Dirk-Jan Mollema and reported to MSRC on 2025-07-14. The flaw exploited an undocumented 'Actor token' mechanism used for internal Microsoft service-to-service communication: Actor tokens are valid for 24 hours, are not logged when issued or used, cannot be revoked, and bypass Conditional Access policies entirely. These tokens are wrapped in an unsigned impersonation JWT, and the legacy Azure AD Graph API (graph.windows.net) failed to validate that the impersonation JWT's tenant-ID claim matched the tenant actually being queried. An attacker able to obtain an Actor token from any tenant (including a self-owned trial tenant) could therefore forge an impersonation token naming an arbitrary target tenant ID and an arbitrary internal user identifier (netId), and the target tenant's Azure AD Graph API would accept it -- effectively allowing impersonation of any identity in any Entra ID tenant, including Global Administrators, with no authentication challenge, no MFA prompt, and no audit trail for read operations. Attackers could obtain valid netId values via incremental brute-forcing, extraction from previously leaked/expired tokens, or via B2B guest-user attributes exposed through cross-tenant trust relationships -- meaning any organization that accepted an external guest invitation became a potential pivot point into unrelated tenants, including theoretically Microsoft's own corporate tenant. Microsoft deployed a global production fix on 2025-07-17 (three days after report) and a secondary mitigation on 2025-08-06 blocking Actor-token issuance via Service Principal credentials for the Azure AD Graph endpoint; the CVE was formally published 2025-09-04. No customer action was required and no in-the-wild exploitation was confirmed prior to the fix, though CISA has since flagged the CVE as having public proof-of-concept / technical exploitation detail available (Mollema's writeup includes attack methodology sufficient to reconstruct the technique). CVE-2025-62557 (CWE-416, Use-After-Free) and CVE-2025-62554 (CWE-843, Type Confusion) are a related pair of Microsoft Office memory-corruption vulnerabilities disclosed in Microsoft's December 2025 Patch Tuesday, each rated 8.4 (Microsoft CNA) / 7.8 (NVD) CVSS v3.1, AV:L/AC:L/PR:L/UI:N -- critically, both are reachable via the Outlook/Explorer Preview Pane, meaning a victim does not need to open, click, or interact with a malicious file; simply previewing a specially crafted Office document (e.g. an email attachment rendered in the reading pane) is sufficient to trigger memory corruption and achieve remote code execution in the context of the logged-on user. CVE-2025-62554 is a type-confusion flaw in Office's object-handling logic where a resource is accessed using an incompatible type, while CVE-2025-62557 is a classic use-after-free in Office's document-parsing engine. Both affect Microsoft 365 Apps for Enterprise, Office 2016/2019, Office LTSC 2021/2024 (Windows and Mac), and Office for Android. Microsoft's guidance for organizations unable to patch immediately is to disable the Outlook/Explorer Preview Pane and thumbnail generation and to enforce Protected View for internet-sourced files. Collectively, these three CVEs -- one maximum-severity cross-tenant identity-impersonation flaw and one zero-click document-preview RCE pair -- serve as concrete illustrations of the report's macro finding: Microsoft's vulnerability surface is shifting away from broad, low-severity bug volume and toward fewer, more severe flaws concentrated in identity/privilege (EoP) and code-execution (RCE) categories across cloud (Entra ID, Azure/Dynamics 365) and productivity (Office) surfaces.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1098.003 Additional Cloud Roles
- T1068 Exploitation for Privilege Escalation
- T1078.004 Cloud Accounts
- T1548 Abuse Elevation Control Mechanism
- T1078.004 Cloud Accounts
- T1685.002 Disable or Modify Cloud Log
- T1556.006 Multi-Factor Authentication
- T1606 Forge Web Credentials
- T1528 Steal Application Access Token
- T1110.004 Credential Stuffing
- T1552 Unsecured Credentials
- T1087.004 Cloud Account
- T1526 Cloud Service Discovery
- T1069.003 Cloud Groups
- T1580 Cloud Infrastructure Discovery
- T1550.001 Application Access Token
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1102 Web Service
- T1531 Account Access Removal
- T1565 Data Manipulation

## Sources

- [Critical Flaws Double as Elevation of Privilege Dominates the Cyber Threats – Analysis of Microsoft Vulnerabilities Report 2026](https://cybersecuritynews.com/microsoft-vulnerabilities-report-2026/)
- [2026 Microsoft Vulnerabilities Report | 13th Edition | BeyondTrust](https://www.beyondtrust.com/resources/whitepapers/microsoft-vulnerability-report)
- [BeyondTrust's 13th Annual Microsoft Vulnerabilities Report Reveals Drop in Total Volume, But Surge in Critical Risk](https://www.globenewswire.com/news-release/2026/04/21/3278040/0/en/beyondtrust-s-13th-annual-microsoft-vulnerabilities-report-reveals-drop-in-total-volume-but-surge-in-critical-risk.html)
- [Critical Microsoft Vulnerabilities Doubled: From Exposure to Escalation](https://www.bleepingcomputer.com/news/security/critical-microsoft-vulnerabilities-doubled-from-exposure-to-escalation/)
- [Microsoft Vulnerabilities Drop, But Critical Flaws Double, Report Warns](https://hackread.com/microsoft-vulnerabilities-drop-critical-flaws-double/)
- [CVE-2025-55241 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-55241)
- [Microsoft Security Response Center: CVE-2025-55241](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241)
- [Obtaining Global Admin in Every Entra ID Tenant via Actor Tokens](https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/)
- [Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants](https://thehackernews.com/2025/09/microsoft-patches-critical-entra-id.html)
- [Critical Entra ID Vulnerability CVE-2025-55241: Microsoft Issues Emergency Fix for Cross-Tenant Token Exploit](https://www.cybermaxx.com/resources/critical-entra-id-vulnerability-cve-2025-55241-microsoft-issues-emergency-fix-for-cross-tenant-token-exploit/)
- [Death by Token: Understanding CVE-2025-55241](https://practical365.com/death-by-token-understanding-cve-2025-55241/)
- [CVE-2025-55241: Critical Cross-Tenant Privilege Escalation in Microsoft Entra ID](https://hivepro.com/threat-advisory/cve-2025-55241-critical-cross-tenant-privilege-escalation-in-microsoft-entra-id/)
- [CVE-2025-62554 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-62554)
- [Microsoft Security Response Center: CVE-2025-62554](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62554)
- [Microsoft Security Response Center: CVE-2025-62557](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62557)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1060