CVE-2025-55241: Microsoft Entra ID Actor Token Flaw Allowed Cross-Tenant Global Admin Impersonation
CVE-2025-55241 (TL-2026-1986), also tracked as One Token to Rule Them All, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-11. It has no confirmed attribution, affects Microsoft Microsoft Entra ID (Azure Active Directory) — legacy Azure, references 1 CVE (CVE-2025-55241), maps to 6 MITRE ATT&CK techniques (T1078, T1087, T1199), and is covered by 9 detection rules and 8 indicators of compromise.
Key facts for TL-2026-1986
- Threat ID
- TL-2026-1986
- Also known as
- One Token to Rule Them All, The Perfect Crime in the Cloud, Entra ID Actor Token Vulnerability
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-08-11
- Last reviewed
- 2026-08-11
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in CVE-2025-55241
Malware and tooling: ROADTools - S0684, roadrecon, roadtx
An undocumented service-to-service "Actor token" mechanism, combined with a tenant-origin validation flaw in the legacy Azure AD Graph API (graph.windows.net), let an attacker obtain an Actor token from their own low-privilege tenant and forge an unsigned impersonation JWT that any other tenant's Graph API accepted, silently impersonating any user including Global Administrators. Researcher Dirk-jan Mollema reported it to MSRC on 2025-07-14; Microsoft deployed a fix on 2025-07-17 and CVE-2025-55241 was published 2025-09-04.
How CVE-2025-55241 works
CVE-2025-55241 ("Azure Entra ID Elevation of Privilege Vulnerability") stems from two components combined by security researcher Dirk-jan Mollema: undocumented "Actor tokens" issued by Microsoft's Access Control Service (ACS) for internal backend service-to-service (S2S) communication, and a tenant-origin validation gap in the legacy Azure AD Graph API (graph.windows.net).
Actor tokens are signed JWTs carrying a `trustedfordelegation: true` claim, issued with a 24-hour validity window, that let Microsoft services such as Exchange Online, SharePoint Online, Skype for Business Online, Dataverse, and Microsoft Dynamics ERP "act as" a user when calling other Microsoft backend services. Any authenticated party (including a low-privilege service principal in an attacker-controlled test tenant) could obtain one of these tokens from ACS. To impersonate a specific user, the caller wraps the signed Actor token inside a second, deliberately UNSIGNED JWT (`"alg": "none"`) containing a `nameid` claim holding the target user's internal "netId" identifier plus `aud`/`iss` claims naming the target tenant.
The flaw: Azure AD Graph API accepted this impersonation token as long as a valid netId existed in the named tenant — it never verified that the wrapped Actor token had actually been issued for, or by, that tenant. Mollema demonstrated this by changing only the tenant ID field in an impersonation token crafted in his own lab tenant; the API returned a "user not found" error (rather than an authentication/tenant-mismatch error) when using a wrong netId, confirming the token itself was accepted cross-tenant. Because netId values are small incrementing integers, they are brute-forceable in minutes to hours per tenant, and Global Administrator netIds could be enumerated the same way. A second pivot exists via Azure AD B2B: guest-user objects store their home-tenant netId in the `alternativeSecurityIds` attribute, so control of any tenant with guest users lets an attacker harvest home-tenant netIds and pivot outward, tenant by tenant.
Because the entire flow occurs directly between the attacker's client and Microsoft's backend token-issuance and Graph API layers, it bypassed MFA and Conditional Access entirely and generated NO log entries for the token issuance or use — the legacy Azure AD Graph API had no request-level audit logging. Only subsequent object modifications performed while impersonating a Global Admin would show up in Microsoft 365 audit logs, and even then with a telltale but easy-to-miss anomaly: the log entry's `InitiatedBy` shows a legitimate Microsoft service display name (e.g., "Office 365 Exchange Online") paired with the impersonated Global Admin's real UPN, rather than the service's own identity.
An attacker who fully exploited this chain could read or modify virtually anything in the victim tenant reachable via Azure AD Graph: user and group objects, Conditional Access policy configuration, application and service principal credentials/secrets, device records including BitLocker recovery keys, and by extension any Azure resource governed at the tenant level.
Mollema reported the flaw to MSRC on 2025-07-14; Microsoft confirmed a production fix on 2025-07-17, days before any public knowledge existed. A follow-up mitigation on 2025-08-06 further restricted Actor token issuance for Azure AD Graph to Microsoft-internal callers only, closing the service-principal-credential path. Azure AD Graph API was separately, and independently, retired globally on 2025-08-31. CVE-2025-55241 was formally published 2025-09-04, and Mollema published the full technical write-up on 2025-09-17. Microsoft states it found no evidence of exploitation prior to the patch, but the complete absence of token-issuance logging means defenders cannot retroactively verify this with certainty for the window before 2025-07-17.
MITRE ATT&CK techniques used in TL-2026-1986
Privilege Escalation
Initial Access
T1078 Valid Accounts; T1199 Trusted Relationship
Discovery
lateral-movement
T1550 Use Alternate Authentication Material
Credential Access
Reconnaissance
Affected products and versions in CVE-2025-55241
- Microsoft — Microsoft Entra ID (Azure Active Directory) — legacy Azure AD Graph API
Vulnerable versions: Azure AD Graph API (graph.windows.net) prior to the 2025-07-17 server-side fix
Fixed in: Server-side fix live globally as of 2025-07-17; additional Actor-token issuance restriction 2025-08-06; Azure AD Graph API fully retired 2025-08-31
Remediation for CVE-2025-55241
Patches
- Microsoft deployed a server-side fix on 2025-07-17 correcting tenant-origin validation for impersonation tokens in the legacy Azure AD Graph API.
- Microsoft added a further mitigation on 2025-08-06 restricting Actor token issuance for Azure AD Graph to Microsoft-internal service callers only, closing the service-principal-credential request path.
Immediate actions
- Confirm the tenant-side Microsoft fix (deployed globally 2025-07-17) is in effect; this was a server-side platform fix requiring no customer action, but tenants should verify via Microsoft 365 admin communications.
- Run the AuditLogs KQL hunting query published by Mollema to look for anomalous pairings of Microsoft-service display names (Office 365 Exchange Online, Skype for Business Online, Dataverse, Office 365 SharePoint Online, Microsoft Dynamics ERP) with real user UPNs in the InitiatedBy field, focused on the window before 2025-07-17.
- Review Conditional Access policy changes, newly created privileged accounts, and application/service-principal credential additions made by Global Administrator accounts in the pre-patch window.
- Audit B2B guest user configurations and external collaboration trust boundaries for signs of cross-tenant netId harvesting.
Workarounds
- Decommission and block all remaining use of the legacy Azure AD Graph API (graph.windows.net), which was officially retired by Microsoft on 2025-08-31.
Longer-term hardening
- Complete migration of any remaining applications, scripts, or automations off the legacy Azure AD Graph API (graph.windows.net) to Microsoft Graph — Azure AD Graph API was fully retired 2025-08-31.
- Increase logging/SIEM coverage and retention for cloud identity provider service-to-service token issuance, not just object modification events.
- Restrict and periodically review B2B guest user trust relationships and cross-tenant collaboration settings.
CVEs associated with CVE-2025-55241
Weaknesses (CWE) in CVE-2025-55241
CWE-287
Timeline of CVE-2025-55241
- Security researcher Dirk-jan Mollema reports the Actor token / Azure AD Graph tenant-validation flaw to the Microsoft Security Response Center (MSRC); MSRC opens a case the same day.
- Microsoft deploys a server-side production fix correcting tenant-origin validation for impersonation tokens in the legacy Azure AD Graph API.
- MSRC confirms to Mollema that the reported issue has been resolved.
- Microsoft applies a further mitigation restricting Actor token issuance for Azure AD Graph to Microsoft-internal service callers only, closing the service-principal-credential request path.
- The legacy Azure AD Graph API (graph.windows.net) is officially and globally retired by Microsoft.
- CVE-2025-55241 (Azure Entra ID Elevation of Privilege Vulnerability) is formally published via MSRC.
- Dirk-jan Mollema publishes the full public technical write-up, "One Token to Rule Them All," detailing the Actor token mechanism and exploitation chain.
- Mitiga publishes its independent technical breakdown of the vulnerability, "The Perfect Crime in the Cloud."
- Mitiga's blog post is updated with additional context, per the article's revision metadata.
Sources cited for CVE-2025-55241
- Breaking Down the Microsoft Entra ID Actor Token Vulnerability: The Perfect Crime in the Cloud
- One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens
- CVE-2025-55241 - Azure Entra ID Elevation of Privilege Vulnerability (MSRC Security Update Guide)
- CVE-2025-55241 Detail
- CVE-2025-55241
- Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants
- All Microsoft Entra Tenants Were Exposed to Silent Compromise via Invisible Actor Tokens: Researcher
- Entra ID vulnerability exposes gaps in cloud identity trust models, experts warn
- Death by Token: Understanding CVE-2025-55241
- CVE-2025-55241: Critical Cross-Tenant Privilege Escalation in Microsoft Entra ID
Threats related to CVE-2025-55241
Detection coverage for TL-2026-1986
As of 2026-08-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1986 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.