Read the docs
TI-2021-18739 Aliases CVE-2021-42306GHSA-vxjx-p5m9-q5fr

Azure Active Directory Information Disclosure Vulnerability

Priority MEDIUM 41CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential  on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the private key data that was added to the application. Azure AD addressed this vulnerability by preventing disclosure of any private key values added to the application. Microsoft has identified services that could manifest this vulnerability, and steps that customers should take to be protected. Refer to the FAQ section for more information. For more details on this issue, please refer to the MSRC Blog Entry.

Why it matters now

EPSS 0.03266 88th percentileScored 2026-11-07
Fix Fixed Azure Automation (Microsoft): publication

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftAzure Active Directory-—No fix listedCNA
MicrosoftAzure Automation1.0.0 to before publicationpublicationPatch availableCNA
MicrosoftAzure Migrate-—No fix listedCNA
MicrosoftAzure Site Recovery-—No fix listedCNA
  • Azure Active Directory VendorMicrosoft Affected - Fixed in — No fix listed CNA
  • Azure Automation VendorMicrosoft Affected 1.0.0 to before publication Fixed in publication Patch available CNA
  • Azure Migrate VendorMicrosoft Affected - Fixed in — No fix listed CNA
  • Azure Site Recovery VendorMicrosoft Affected - Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:azure_active_directory:*:*:*:*:*:*:*:*before 2021-10-30VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_active_site_recovery:*:*:*:*:*:*:*:*before 2021-11-01VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_automation:*:*:*:*:*:*:*:*before 2021-10-15VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_migrate:*:*:*:*:*:*:*:*before 2021-11-02VulnerableMicrosoft
  • cpe:2.3:a:microsoft:azure_active_directory:*:*:*:*:*:*:*:* Versions before 2021-10-30 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_active_site_recovery:*:*:*:*:*:*:*:* Versions before 2021-11-01 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_automation:*:*:*:*:*:*:*:* Versions before 2021-10-15 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_migrate:*:*:*:*:*:*:*:* Versions before 2021-11-02 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Azure Automation (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42306
  2. 2026-10-03 Alias added: GHSA-vxjx-p5m9-q5fr

References

Patch 2

  • TI-2026-33251 Azure Active Directory Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2026-37217 Azure Active Directory Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2026-37341 Azure Active Directory Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-37342 Azure Active Directory Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-14141 Microsoft Azure Active Directory B2C Spoofing Vulnerability CVSS 3.1MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences