Microsoft Patches Entra ID Role Flaw That Enabled Service Principal Takeover

A wave of active exploitation and supply-chain incidents was reported: Microsoft patched an Entra ID built-in role (Agent ID Administrator) vulnerability that could enable privilege escalation and service-principal takeover, and acknowledged active exploitation of Windows Shell (CVE-2026-32202). Multiple supply-chain compromises and data leaks were disclosed — Checkmarx-related GitHub data posted to the dark web, Bitwarden CLI compromised in the Checkmarx campaign, malicious Checkmarx KICS Docker images and VS Code extension attacks (GlassWorm), and 26 fake wallet apps on the App Store. High‑r