What is the CVSS score of CVE-2026-50652?

CVE-2026-50652 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.2%.

How to fix or mitigate CVE-2026-50652?

Within 24 hours, assess organizational exposure to CVE-2026-50652, identify all Azure AD instances in use, and obtain the patch version from Microsoft Security Response Center (MSRC). Within 7 days, deploy the patch to staging environments and validate compatibility with critical applications and conditional access policies. Within 30 days, complete rollout of the patch to all production Azure AD instances.

Azure Active Directory CVE-2026-50652

Q: Which versions of Azure Active Directory are affected by CVE-2026-50652?

Microsoft Azure Active Directory (Entra ID) is vulnerable to a remote denial-of-service attack that could prevent legitimate users from authenticating and accessing cloud applications and services.. A patch is available.

EUVD-2026-43781 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-14 microsoft

GHSA-79fq-78m6-5rrm

Deserialization Microsoft Azure Active Directory

7.5

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach network-exposed Azure AD endpoint
Delivery

Send crafted serialized payload
Exploit

Trigger unsafe deserialization (CWE-502)
Execution

Exhaust resources or crash handler
Impact

Deny identity service to users

Vulnerability Assessment

Weakness	CWE CWE-502 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V1 - Encoding and Sanitization Safe deserialization, type allowlists MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against a network-reachable Azure Active Directory endpoint, requiring only the ability to send a crafted serialized request. The primary limiting factor is scope of impact: the vulnerability only degrades availability (A:H) and cannot be used to read data or alter identity records (C:N/I:N). Because Azure AD is a Microsoft-hosted cloud service, exploitability in practice is also gated by Microsoft's platform-level protections and the fact that the vendor has already deployed a fix; customer-controlled exposure is largely limited to hybrid/federation components.
Impact	The signals are moderately consistent but point to a real, easily-triggered availability risk rather than a catastrophic compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N) means exploitation is network-reachable, low-complexity, unauthenticated, and requires no user interaction - the maximum reachability profile - which is why the score sits at 7.5. However, the impact is bounded strictly to availability (A:H, C:N, I:N), so this is a service-disruption issue, not data theft or takeover. No EPSS score was provided in the input, and there is no KEV listing and no public exploit identified, which lowers near-term real-world urgency relative to the raw CVSS number. Because Azure AD is a Microsoft-operated cloud service, much of the remediation burden and blast radius is managed by Microsoft's platform rather than each customer, further tempering practical customer-side risk. Net: prioritize awareness and confirm the Microsoft-side fix is in effect, but this is a high-CVSS-but-availability-only issue rather than a code-execution emergency.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends a crafted serialized payload to a network-exposed Azure AD processing endpoint, triggering unsafe deserialization that exhausts resources or crashes the handling component and denies authentication/identity service to legitimate users and applications. No credentials, user interaction, or non-default configuration are required, making the request trivial to send. No public exploit code has been identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 1.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Denial of service in Microsoft Azure Active Directory (now Entra ID) allows a remote, unauthenticated attacker to disrupt service availability by sending crafted serialized data that triggers unsafe deserialization (CWE-502). The flaw carries a CVSS 7.5 (High) with a fully network-reachable, no-privilege, no-interaction vector, but impact is confined to availability - confidentiality and integrity are not affected. Microsoft has released a fix via MSRC; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

RemediationAI

Patch available per vendor advisory: Microsoft has released a fix, published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50652 - review that advisory for the exact affected components and any customer action required, as much of the fix for a cloud identity service is applied by Microsoft platform-side and may need no direct action. For any on-premises or hybrid identity components under your control (for example Entra Connect / AD FS federation endpoints), ensure they are updated to the latest supported build. As compensating controls while confirming coverage, restrict and monitor network exposure of identity/federation endpoints (limit inbound access to trusted networks or via a WAF), enable rate-limiting on authentication endpoints to blunt resource-exhaustion attempts, and alert on abnormal request volumes or malformed-payload errors against sign-in endpoints; note that aggressive network restriction on a federation endpoint can break legitimate SSO for remote users and should be validated against your access patterns.

Affected VersionsENISA

Azure Active Directory 2021 <5.7.1

Affected Packages

euvd azure_active_directory fix: 5.7.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Azure Active Directory / Entra ID is Microsoft's cloud identity and access management (IdP) service underpinning authentication for Microsoft 365, Azure, and countless federated third-party applications. The root cause is classified as CWE-502 (Deserialization of Untrusted Data): a component accepts serialized objects from an untrusted network source and reconstructs them without adequate validation. While CWE-502 is frequently associated with remote code execution, the CVSS impact profile here (C:N/I:N/A:H) indicates the deserialization path leads to a resource-exhaustion or crash condition (e.g., a malformed object graph consuming CPU/memory or throwing an unhandled fault in the processing service) rather than object-injection code execution. The affected component is identified by CPE cpe:2.3:a:microsoft:azure_active_directory as a service/application-tier vulnerability rather than an on-premises binary.

Know when Azure Active Directory gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD HIGH

vuln.today AI 7.5 HIGH

Network-reachable, low-complexity, unauthenticated deserialization with no user interaction (AV:N/AC:L/PR:N/UI:N); impact limited to availability so C:N/I:N/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Executive ViewAI

Why It Matters

Microsoft Azure Active Directory (Entra ID) is vulnerable to a remote denial-of-service attack that could prevent legitimate users from authenticating and accessing cloud applications and services. Any organization depending on Azure AD for identity management-which represents the vast majority of enterprises using Microsoft cloud services-faces potential business disruption and user productivity loss. A vendor patch is available and should be deployed urgently.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

1.2%

Top 36% exploitable

Prevalence

Ubiquitous

core cloud identity provider for Microsoft 365 and Azure worldwide

Threat Intel

1 sources

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 1.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.