EUVD-2026-43781
GHSA-79fq-78m6-5rrm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity, unauthenticated deserialization with no user interaction (AV:N/AC:L/PR:N/UI:N); impact limited to availability so C:N/I:N/A:H, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
AnalysisAI
Denial of service in Microsoft Azure Active Directory (now Entra ID) allows a remote, unauthenticated attacker to disrupt service availability by sending crafted serialized data that triggers unsafe deserialization (CWE-502). The flaw carries a CVSS 7.5 (High) with a fully network-reachable, no-privilege, no-interaction vector, but impact is confined to availability - confidentiality and integrity are not affected. Microsoft has released a fix via MSRC; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Azure Active Directory / Entra ID is Microsoft's cloud identity and access management (IdP) service underpinning authentication for Microsoft 365, Azure, and countless federated third-party applications. The root cause is classified as CWE-502 (Deserialization of Untrusted Data): a component accepts serialized objects from an untrusted network source and reconstructs them without adequate validation. While CWE-502 is frequently associated with remote code execution, the CVSS impact profile here (C:N/I:N/A:H) indicates the deserialization path leads to a resource-exhaustion or crash condition (e.g., a malformed object graph consuming CPU/memory or throwing an unhandled fault in the processing service) rather than object-injection code execution. The affected component is identified by CPE cpe:2.3:a:microsoft:azure_active_directory as a service/application-tier vulnerability rather than an on-premises binary.
RemediationAI
Patch available per vendor advisory: Microsoft has released a fix, published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50652 - review that advisory for the exact affected components and any customer action required, as much of the fix for a cloud identity service is applied by Microsoft platform-side and may need no direct action. For any on-premises or hybrid identity components under your control (for example Entra Connect / AD FS federation endpoints), ensure they are updated to the latest supported build. As compensating controls while confirming coverage, restrict and monitor network exposure of identity/federation endpoints (limit inbound access to trusted networks or via a WAF), enable rate-limiting on authentication endpoints to blunt resource-exhaustion attempts, and alert on abnormal request volumes or malformed-payload errors against sign-in endpoints; note that aggressive network restriction on a federation endpoint can break legitimate SSO for remote users and should be validated against your access patterns.
More in Azure Active Directory
View allPrivilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacke
Privilege escalation in Microsoft Azure Active Directory allows unauthenticated remote attackers to bypass authenticatio
An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as
Denial of service in Microsoft Azure Active Directory (Entra ID) allows a remote unauthenticated attacker to send networ
Microsoft Azure Active Directory B2C Spoofing Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is rem
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today