Read the docs
TI-2026-37341 Aliases CVE-2026-50652GHSA-79fq-78m6-5rrm

Azure Active Directory Denial of Service Vulnerability

Priority MEDIUM 42CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0173 77th percentileScored 2026-11-07
Fix Fixed Microsoft: 19 updates

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftAzure Active Directory2021 to before 5.7.15.7.1Patch availableCNA
MicrosoftMicrosoft .NET Framework 3.53.5.0 to before 2.0.50727.9182 & 3.0.30729.91682.0.50727.9182 & 3.0.30729.9168Patch availableCNA
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.24.7.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.02.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0Patch availableCNA
MicrosoftMicrosoft .NET Framework 3.5 AND 4.84.8.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.02.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0Patch availableCNA
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8.14.8.1 to before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.02.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0Patch availableCNA
MicrosoftMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.24.7.0 to before 4.7.4143.04.7.4143.0Patch availableCNA
MicrosoftMicrosoft .NET Framework 4.84.8.0 to before 4.8.4803.04.8.4803.0Patch availableCNA
MicrosoftMicrosoft .NET Framework 4.8.14.8.0.0 to before 4.8.9340.04.8.9340.0Patch availableCNA
  • Azure Active Directory VendorMicrosoft Affected 2021 to before 5.7.1 Fixed in 5.7.1 Patch available CNA
  • Microsoft .NET Framework 3.5 VendorMicrosoft Affected 3.5.0 to before 2.0.50727.9182 & 3.0.30729.9168 Fixed in 2.0.50727.9182 & 3.0.30729.9168 Patch available CNA
  • Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 Fixed in 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 Patch available CNA
  • Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 Fixed in 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 Patch available CNA
  • Microsoft .NET Framework 3.5 AND 4.8.1 VendorMicrosoft Affected 4.8.1 to before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 Patch available CNA
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.4143.0 Fixed in 4.7.4143.0 Patch available CNA
  • Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.4803.0 Fixed in 4.8.4803.0 Patch available CNA
  • Microsoft .NET Framework 4.8.1 VendorMicrosoft Affected 4.8.0.0 to before 4.8.9340.0 Fixed in 4.8.9340.0 Patch available CNA

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*3.5VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:arm64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:x64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:arm64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:x64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*r2Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*4.8.1VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*4.6.2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*4.7VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*4.7.1VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*4.7.2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*4.8VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_active_directory:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* Versions 4.8.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_active_directory:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

Microsoft 19 updates

  • KB5101014
    Security Update
    • Microsoft .NET Framework 3.5 2.0.50727.9182 & 3.0.30729.9168
    • Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168
  • KB5101011
    Security Update
    • Microsoft .NET Framework 4.8 4.8.4803.0
  • KB5101010
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8 2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0
Show 16 more Microsoft updates
  • KB5101009
    Security Update
    • Microsoft .NET Framework 4.8 4.8.4803.0
  • KB5101008
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
  • KB5101007
    Security Update
    • Microsoft .NET Framework 4.8 4.8.4803.0
  • KB5101006
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8 2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0
  • KB5101005
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
  • KB5101004
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
  • KB5101002
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8.1 4.8.9340.0
    • Microsoft .NET Framework 4.8.1 4.8.9340.0
  • KB5101001
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
  • KB5101000
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
  • KB5100998
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9340.0
  • KB5100991
    Security Update
    • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.4143.0
  • KB5100990
    Security Update
    • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.4143.0
  • KB5100989
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.7.2 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
  • KB5100985
    Security Update
    • Microsoft .NET Framework 3.5 2.0.50727.8983 & 3.0.30729.8978
  • KB5100984
    Security Update
    • Microsoft .NET Framework 3.5 2.0.50727.8983 & 3.0.30729.8978
  • KB5099535
    Security Update
    • Microsoft .NET Framework 3.5 AND 4.7.2 2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0
    • Windows 10 Version 1607 for 32-bit Systems 10.0.14393.9339
    • Windows 10 Version 1607 for x64-based Systems 10.0.14393.9339
    • Windows Server 2016 10.0.14393.9339
    • Windows Server 2016 (Server Core installation) 10.0.14393.9339

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Denial of Service
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Azure Active DirectoryFixed 5.7.1 · Security Update
Azure Active DirectoryFixed 7.7.3 · Security Update
Azure Active DirectoryFixed 8.19.2 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50652
  2. 2026-10-03 Alias added: GHSA-79fq-78m6-5rrm

References

Patch 1

  • TI-2020-00622 XML injection in Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
  • TI-2017-06273 Code injection in Microsoft .NET Framework KEVCVSS 3.1HIGH 7.8
  • TI-2015-01495 The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1… KEVCVSS 3.1HIGH 7.8
  • TI-2024-19239 .NET Framework Information Disclosure Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2023-18684 ASP.NET Elevation of Privilege Vulnerability CVSS 3.1HIGH 8.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences