cve 2026 40379

CVE-2026-40379 is a critical spoofing vulnerability in Microsoft's Enterprise Security Token Service (ESTS) affecting Azure Entra ID. Disclosed on May 7, 2026, the flaw could expose sensitive information to unauthorized actors. Microsoft fully mitigated the cloud-service issue without requiring customer action. The tag covers discussions about the vulnerability's disclosure, its implications for enterprise security, and the broader concern that critical identity-plane flaws are fixed silently in the cloud, leaving organizations unable to inspect or validate the fix independently.