Vulnerability-Lookup

CVE-2026-50653 (GCVE-0-2026-50653)

Vulnerability from cvelistv5 – Published: 2026-07-14 17:05 – Updated: 2026-08-03 22:53

Title

Azure Active Directory Denial of Service Vulnerability

Summary

Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-400 - Uncontrolled Resource Consumption

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisorypatch

Impacted products

8 products

Vendor	Product	Version
Microsoft	Azure Active Directory	Affected: 2021 , < 8.19.2 (custom)
Microsoft	Microsoft .NET Framework 3.5	Affected: 3.5.0 , < 2.0.50727.9182 & 3.0.30729.9168 (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	Affected: 4.7.0 , < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	Affected: 4.8.0 , < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 (custom)
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	Affected: 4.8.1 , < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 (custom)
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	Affected: 4.7.0 , < 4.7.4143.0 (custom)
Microsoft	Microsoft .NET Framework 4.8	Affected: 4.8.0 , < 4.8.4803.0 (custom)
Microsoft	Microsoft .NET Framework 4.8.1	Affected: 4.8.0.0 , < 4.8.9340.0 (custom)

Date Public

2026-07-14 14:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50653",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T20:37:40.854539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T20:48:11.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Azure Active Directory",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "8.19.2",
              "status": "affected",
              "version": "2021",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 11 Version 26H1 for ARM64-based Systems",
            "Windows 11 version 26H1 for x64-based Systems",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9182 \u0026 3.0.30729.9168",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows Server 2016",
            "Windows Server 2016 (Server Core installation)",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.7.4143.0",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows 10 Version 21H2 for 32-bit Systems",
            "Windows 10 Version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for x64-based Systems",
            "Windows 10 Version 22H2 for 32-bit Systems",
            "Windows 10 Version 22H2 for ARM64-based Systems",
            "Windows 10 Version 22H2 for x64-based Systems",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)",
            "Windows Server 2022",
            "Windows Server 2022 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.8.4803.0",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 21H2 for 32-bit Systems",
            "Windows 10 Version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for x64-based Systems",
            "Windows 10 Version 22H2 for 32-bit Systems",
            "Windows 10 Version 22H2 for ARM64-based Systems",
            "Windows 10 Version 22H2 for x64-based Systems",
            "Windows 11 Version 23H2 for ARM64-based Systems",
            "Windows 11 Version 23H2 for x64-based Systems",
            "Windows 11 Version 24H2 for ARM64-based Systems",
            "Windows 11 Version 24H2 for x64-based Systems",
            "Windows 11 Version 25H2 for ARM64-based Systems",
            "Windows 11 Version 25H2 for x64-based Systems",
            "Windows Server 2022",
            "Windows Server 2022 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9182 \u0026 3.0.30729.9168 \u0026 4.8.9339.0",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.7.4143.0",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)",
            "Windows Server 2016",
            "Windows Server 2016 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.4803.0",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 11 Version 26H1 for ARM64-based Systems",
            "Windows 11 version 26H1 for x64-based Systems"
          ],
          "product": "Microsoft .NET Framework 4.8.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.9340.0",
              "status": "affected",
              "version": "4.8.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_active_directory:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.19.2",
                  "versionStartIncluding": "2021",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.50727.9182 \u0026 3.0.30729.9168",
                  "versionStartIncluding": "3.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.8.9340.0",
                  "versionStartIncluding": "4.8.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.8.4803.0",
                  "versionStartIncluding": "4.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.8.4803.0",
                  "versionStartIncluding": "4.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.7.4143.0",
                  "versionStartIncluding": "4.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.7.4143.0",
                  "versionStartIncluding": "4.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.50727.9182 \u0026 3.0.30729.9168 \u0026 4.8.9339.0",
                  "versionStartIncluding": "4.8.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-07-14T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Loop with unreachable exit condition (\u0027infinite loop\u0027) in Azure Active Directory allows an unauthorized attacker to deny service over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en-US",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-03T22:53:56.541Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Active Directory Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653"
        }
      ],
      "title": "Azure Active Directory Denial of Service Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-50653",
    "datePublished": "2026-07-14T17:05:39.461Z",
    "dateReserved": "2026-06-05T14:33:50.831Z",
    "dateUpdated": "2026-08-03T22:53:56.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-50653",
      "date": "2026-08-04",
      "epss": "0.0078",
      "percentile": "0.52383"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-50653\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2026-07-14T17:17:01.790\",\"lastModified\":\"2026-07-24T15:15:06.173\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Loop with unreachable exit condition (\u0027infinite loop\u0027) in Azure Active Directory allows an unauthorized attacker to deny service over a network.\"}],\"affected\":[{\"source\":\"secure@microsoft.com\",\"affectedData\":[{\"vendor\":\"Microsoft\",\"product\":\"Azure Active Directory\",\"versions\":[{\"version\":\"2021\",\"lessThan\":\"8.19.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Microsoft\",\"product\":\"Microsoft .NET Framework 3.5\",\"platforms\":[\"Windows 11 Version 26H1 for ARM64-based Systems\",\"Windows 11 version 26H1 for x64-based Systems\",\"Windows Server 2012\",\"Windows Server 2012 (Server Core installation)\",\"Windows Server 2012 R2\",\"Windows Server 2012 R2 (Server Core installation)\"],\"versions\":[{\"version\":\"3.5.0\",\"lessThan\":\"2.0.50727.9182 \u0026 3.0.30729.9168\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Microsoft\",\"product\":\"Microsoft .NET Framework 3.5 AND 4.7.2\",\"platforms\":[\"Windows 10 Version 1607 for 32-bit Systems\",\"Windows 10 Version 1607 for x64-based Systems\",\"Windows 10 Version 1809 for 32-bit Systems\",\"Windows 10 Version 1809 for x64-based Systems\",\"Windows Server 2016\",\"Windows Server 2016 (Server Core installation)\",\"Windows Server 2019\",\"Windows Server 2019 (Server Core installation)\"],\"versions\":[{\"version\":\"4.7.0\",\"lessThan\":\"2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.7.4143.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Microsoft\",\"product\":\"Microsoft .NET Framework 3.5 AND 4.8\",\"platforms\":[\"Windows 10 Version 1809 for 32-bit Systems\",\"Windows 10 Version 1809 for x64-based Systems\",\"Windows 10 Version 21H2 for 32-bit Systems\",\"Windows 10 Version 21H2 for ARM64-based Systems\",\"Windows 10 Version 21H2 for x64-based Systems\",\"Windows 10 Version 22H2 for 32-bit Systems\",\"Windows 10 Version 22H2 for ARM64-based Systems\",\"Windows 10 Version 22H2 for x64-based Systems\",\"Windows Server 2019\",\"Windows Server 2019 (Server Core installation)\",\"Windows Server 2022\",\"Windows Server 2022 (Server Core installation)\"],\"versions\":[{\"version\":\"4.8.0\",\"lessThan\":\"2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.8.4803.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Microsoft\",\"product\":\"Microsoft .NET Framework 3.5 AND 4.8.1\",\"platforms\":[\"Windows 10 Version 21H2 for 32-bit Systems\",\"Windows 10 Version 21H2 for ARM64-based Systems\",\"Windows 10 Version 21H2 for x64-based Systems\",\"Windows 10 Version 22H2 for 32-bit Systems\",\"Windows 10 Version 22H2 for ARM64-based Systems\",\"Windows 10 Version 22H2 for x64-based Systems\",\"Windows 11 Version 23H2 for ARM64-based Systems\",\"Windows 11 Version 23H2 for x64-based Systems\",\"Windows 11 Version 24H2 for ARM64-based Systems\",\"Windows 11 Version 24H2 for x64-based Systems\",\"Windows 11 Version 25H2 for ARM64-based Systems\",\"Windows 11 Version 25H2 for x64-based Systems\",\"Windows Server 2022\",\"Windows Server 2022 (Server Core installation)\"],\"versions\":[{\"version\":\"4.8.1\",\"lessThan\":\"2.0.50727.9182 \u0026 3.0.30729.9168 \u0026 4.8.9339.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Microsoft\",\"product\":\"Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2\",\"platforms\":[\"Windows Server 2012\",\"Windows Server 2012 (Server Core installation)\",\"Windows Server 2012 R2\",\"Windows Server 2012 R2 (Server Core installation)\"],\"versions\":[{\"version\":\"4.7.0\",\"lessThan\":\"4.7.4143.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Microsoft\",\"product\":\"Microsoft .NET Framework 4.8\",\"platforms\":[\"Windows 10 Version 1607 for 32-bit Systems\",\"Windows 10 Version 1607 for x64-based Systems\",\"Windows Server 2012\",\"Windows Server 2012 (Server Core installation)\",\"Windows Server 2012 R2\",\"Windows Server 2012 R2 (Server Core installation)\",\"Windows Server 2016\",\"Windows Server 2016 (Server Core installation)\"],\"versions\":[{\"version\":\"4.8.0\",\"lessThan\":\"4.8.4803.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Microsoft\",\"product\":\"Microsoft .NET Framework 4.8.1\",\"platforms\":[\"Windows 11 Version 26H1 for ARM64-based Systems\",\"Windows 11 version 26H1 for x64-based Systems\"],\"versions\":[{\"version\":\"4.8.0.0\",\"lessThan\":\"4.8.9340.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-14T20:37:40.854539Z\",\"id\":\"CVE-2026-50653\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"},{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"23317443-1968-4791-9F20-AD3B308A83D1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"5E491E46-1917-41FE-8F9A-BB0BDDEB42C3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"0A1BC97A-263E-4291-8AEF-02EE4E6031E9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"306B7CE6-8239-4AED-9ED4-4C9F5B349F58\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"345FCD64-D37B-425B-B64C-8B1640B7E850\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"8FC46499-DB6E-48BF-9334-85EE27AFE7AF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"83A79DD6-E74E-419F-93F1-323B68502633\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"61959ACC-B608-4556-92AF-4D94B338907A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"A9D54EE6-30AF-411C-A285-A4DCB6C6EC06\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"C230D3BF-7FCE-405C-B62E-B9190C995C3C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"1FD62DCB-66D1-4CEA-828E-0BD302AC63CA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"B0301BA0-81DB-4FC1-9BC3-EB48A56BC608\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"8E3C1327-F331-4448-A253-00EAC7428317\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"08EE1F3A-A8DE-4867-BB5B-8A8ED867F3CA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"B1670829-6A8C-4688-B7A5-3DFB878A4861\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"25D142AB-B61D-43F3-B7E6-DB9140EFEF75\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"CBFE0371-0C4D-406A-9EC7-456104271C3E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"F2B83840-FCE8-445A-AE55-ACEDA6534FA1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB18C4CE-5917-401E-ACF7-2747084FD36E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB79EE26-FC32-417D-A49C-A1A63165A968\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"821614DD-37DD-44E2-A8A4-FE8D23A33C3C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"934D4E46-12C1-41DC-A28C-A2C430E965E4\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"8FC46499-DB6E-48BF-9334-85EE27AFE7AF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"83A79DD6-E74E-419F-93F1-323B68502633\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"61959ACC-B608-4556-92AF-4D94B338907A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"A9D54EE6-30AF-411C-A285-A4DCB6C6EC06\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"C230D3BF-7FCE-405C-B62E-B9190C995C3C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"1FD62DCB-66D1-4CEA-828E-0BD302AC63CA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"B0301BA0-81DB-4FC1-9BC3-EB48A56BC608\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"8E3C1327-F331-4448-A253-00EAC7428317\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"08EE1F3A-A8DE-4867-BB5B-8A8ED867F3CA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"B1670829-6A8C-4688-B7A5-3DFB878A4861\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"25D142AB-B61D-43F3-B7E6-DB9140EFEF75\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"CBFE0371-0C4D-406A-9EC7-456104271C3E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"F2B83840-FCE8-445A-AE55-ACEDA6534FA1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"821614DD-37DD-44E2-A8A4-FE8D23A33C3C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A16AD2B0-2189-4E8E-B7FC-CE598CA1CB2D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB18C4CE-5917-401E-ACF7-2747084FD36E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"734112B3-1383-4BE3-8721-C0F84566B764\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB18C4CE-5917-401E-ACF7-2747084FD36E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36B0E40A-84EF-4099-A395-75D6B8CDA196\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB18C4CE-5917-401E-ACF7-2747084FD36E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF7A75E-EE27-4AA7-8D84-9D696728A4CE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"5E491E46-1917-41FE-8F9A-BB0BDDEB42C3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"0A1BC97A-263E-4291-8AEF-02EE4E6031E9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"306B7CE6-8239-4AED-9ED4-4C9F5B349F58\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"345FCD64-D37B-425B-B64C-8B1640B7E850\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB18C4CE-5917-401E-ACF7-2747084FD36E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB79EE26-FC32-417D-A49C-A1A63165A968\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:azure_active_directory:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CF5AE58-9819-45B6-BE7F-49B8F3CBE542\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D3F18AF-84ED-473B-A8DF-65EB23C475AF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"5E491E46-1917-41FE-8F9A-BB0BDDEB42C3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"0A1BC97A-263E-4291-8AEF-02EE4E6031E9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"306B7CE6-8239-4AED-9ED4-4C9F5B349F58\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"345FCD64-D37B-425B-B64C-8B1640B7E850\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"8FC46499-DB6E-48BF-9334-85EE27AFE7AF\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"83A79DD6-E74E-419F-93F1-323B68502633\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"61959ACC-B608-4556-92AF-4D94B338907A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:*\",\"matchCriteriaId\":\"A9D54EE6-30AF-411C-A285-A4DCB6C6EC06\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"C230D3BF-7FCE-405C-B62E-B9190C995C3C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:*\",\"matchCriteriaId\":\"1FD62DCB-66D1-4CEA-828E-0BD302AC63CA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7DF96F8-BA6A-4780-9CA3-F719B3F81074\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB18C4CE-5917-401E-ACF7-2747084FD36E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB79EE26-FC32-417D-A49C-A1A63165A968\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"821614DD-37DD-44E2-A8A4-FE8D23A33C3C\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Vendor Advisory\",\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-50653\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-14T20:37:40.854539Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-14T20:40:06.949Z\"}}], \"cna\": {\"title\": \"Azure Active Directory Denial of Service Vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"Azure Active Directory\", \"versions\": [{\"status\": \"affected\", \"version\": \"2021\", \"lessThan\": \"8.19.2\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft .NET Framework 3.5\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"2.0.50727.9182 \u0026 3.0.30729.9168\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows 11 Version 26H1 for ARM64-based Systems\", \"Windows 11 version 26H1 for x64-based Systems\", \"Windows Server 2012\", \"Windows Server 2012 (Server Core installation)\", \"Windows Server 2012 R2\", \"Windows Server 2012 R2 (Server Core installation)\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft .NET Framework 3.5 AND 4.7.2\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7.0\", \"lessThan\": \"2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.7.4143.0\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows 10 Version 1607 for 32-bit Systems\", \"Windows 10 Version 1607 for x64-based Systems\", \"Windows 10 Version 1809 for 32-bit Systems\", \"Windows 10 Version 1809 for x64-based Systems\", \"Windows Server 2016\", \"Windows Server 2016 (Server Core installation)\", \"Windows Server 2019\", \"Windows Server 2019 (Server Core installation)\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft .NET Framework 3.5 AND 4.8\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8.0\", \"lessThan\": \"2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.8.4803.0\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows 10 Version 1809 for 32-bit Systems\", \"Windows 10 Version 1809 for x64-based Systems\", \"Windows 10 Version 21H2 for 32-bit Systems\", \"Windows 10 Version 21H2 for ARM64-based Systems\", \"Windows 10 Version 21H2 for x64-based Systems\", \"Windows 10 Version 22H2 for 32-bit Systems\", \"Windows 10 Version 22H2 for ARM64-based Systems\", \"Windows 10 Version 22H2 for x64-based Systems\", \"Windows Server 2019\", \"Windows Server 2019 (Server Core installation)\", \"Windows Server 2022\", \"Windows Server 2022 (Server Core installation)\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft .NET Framework 3.5 AND 4.8.1\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8.1\", \"lessThan\": \"2.0.50727.9182 \u0026 3.0.30729.9168 \u0026 4.8.9339.0\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows 10 Version 21H2 for 32-bit Systems\", \"Windows 10 Version 21H2 for ARM64-based Systems\", \"Windows 10 Version 21H2 for x64-based Systems\", \"Windows 10 Version 22H2 for 32-bit Systems\", \"Windows 10 Version 22H2 for ARM64-based Systems\", \"Windows 10 Version 22H2 for x64-based Systems\", \"Windows 11 Version 23H2 for ARM64-based Systems\", \"Windows 11 Version 23H2 for x64-based Systems\", \"Windows 11 Version 24H2 for ARM64-based Systems\", \"Windows 11 Version 24H2 for x64-based Systems\", \"Windows 11 Version 25H2 for ARM64-based Systems\", \"Windows 11 Version 25H2 for x64-based Systems\", \"Windows Server 2022\", \"Windows Server 2022 (Server Core installation)\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7.0\", \"lessThan\": \"4.7.4143.0\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows Server 2012\", \"Windows Server 2012 (Server Core installation)\", \"Windows Server 2012 R2\", \"Windows Server 2012 R2 (Server Core installation)\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft .NET Framework 4.8\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8.0\", \"lessThan\": \"4.8.4803.0\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows 10 Version 1607 for 32-bit Systems\", \"Windows 10 Version 1607 for x64-based Systems\", \"Windows Server 2012\", \"Windows Server 2012 (Server Core installation)\", \"Windows Server 2012 R2\", \"Windows Server 2012 R2 (Server Core installation)\", \"Windows Server 2016\", \"Windows Server 2016 (Server Core installation)\"]}, {\"vendor\": \"Microsoft\", \"product\": \"Microsoft .NET Framework 4.8.1\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8.0.0\", \"lessThan\": \"4.8.9340.0\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows 11 Version 26H1 for ARM64-based Systems\", \"Windows 11 version 26H1 for x64-based Systems\"]}], \"datePublic\": \"2026-07-14T14:00:00.000Z\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653\", \"name\": \"Azure Active Directory Denial of Service Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Loop with unreachable exit condition (\u0027infinite loop\u0027) in Azure Active Directory allows an unauthorized attacker to deny service over a network.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}, {\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:azure_active_directory:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"8.19.2\", \"versionStartIncluding\": \"2021\"}, {\"criteria\": \"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.0.50727.9182 \u0026 3.0.30729.9168\", \"versionStartIncluding\": \"3.5.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.8.9340.0\", \"versionStartIncluding\": \"4.8.0.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.8.4803.0\", \"versionStartIncluding\": \"4.8.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.8.4803.0\", \"versionStartIncluding\": \"4.8.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.7.4143.0\", \"versionStartIncluding\": \"4.7.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.7.4143.0\", \"versionStartIncluding\": \"4.7.0\"}, {\"criteria\": \"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.0.50727.9182 \u0026 3.0.30729.9168 \u0026 4.8.9339.0\", \"versionStartIncluding\": \"4.8.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2026-08-03T22:53:56.541Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-50653\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-03T22:53:56.541Z\", \"dateReserved\": \"2026-06-05T14:33:50.831Z\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2026-07-14T17:05:39.461Z\", \"assignerShortName\": \"microsoft\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0871

Vulnerability from certfr_avis - Published: 2026-07-15 - Updated: 2026-07-15

De multiples vulnérabilités ont été découvertes dans Microsoft Azure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Microsoft	Azure	Azure Monitor Agent Metrics Extension versions antérieures à 1.65
Microsoft	Azure	Azure Active Directory versions antérieures à 5.7.1
Microsoft	Azure	Azure CycleCloud 8.9.1 versions antérieures à 8.9.1
Microsoft	Azure	Azure Spring Apps versions antérieures à 7.3.0
Microsoft	Azure	Azure Active Directory versions antérieures à 8.19.2

References

Title

Publication Time

FKIE_CVE-2026-50653

Vulnerability from fkie_nvd - Published: 2026-07-14 17:17 - Updated: 2026-07-22 16:18

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

References

	URL	Tags
	secure@microsoft.com	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Azure Active Directory",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "8.19.2",
              "status": "affected",
              "version": "2021",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 11 Version 26H1 for ARM64-based Systems",
            "Windows 11 version 26H1 for x64-based Systems",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9182 \u0026 3.0.30729.9168",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows Server 2016",
            "Windows Server 2016 (Server Core installation)",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.7.4143.0",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1809 for 32-bit Systems",
            "Windows 10 Version 1809 for x64-based Systems",
            "Windows 10 Version 21H2 for 32-bit Systems",
            "Windows 10 Version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for x64-based Systems",
            "Windows 10 Version 22H2 for 32-bit Systems",
            "Windows 10 Version 22H2 for ARM64-based Systems",
            "Windows 10 Version 22H2 for x64-based Systems",
            "Windows Server 2019",
            "Windows Server 2019 (Server Core installation)",
            "Windows Server 2022",
            "Windows Server 2022 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9069 \u0026 3.0.30729.9067 \u0026 4.8.4803.0",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 21H2 for 32-bit Systems",
            "Windows 10 Version 21H2 for ARM64-based Systems",
            "Windows 10 Version 21H2 for x64-based Systems",
            "Windows 10 Version 22H2 for 32-bit Systems",
            "Windows 10 Version 22H2 for ARM64-based Systems",
            "Windows 10 Version 22H2 for x64-based Systems",
            "Windows 11 Version 23H2 for ARM64-based Systems",
            "Windows 11 Version 23H2 for x64-based Systems",
            "Windows 11 Version 24H2 for ARM64-based Systems",
            "Windows 11 Version 24H2 for x64-based Systems",
            "Windows 11 Version 25H2 for ARM64-based Systems",
            "Windows 11 Version 25H2 for x64-based Systems",
            "Windows Server 2022",
            "Windows Server 2022 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 3.5 AND 4.8.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "2.0.50727.9182 \u0026 3.0.30729.9168 \u0026 4.8.9339.0",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.7.4143.0",
              "status": "affected",
              "version": "4.7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 10 Version 1607 for 32-bit Systems",
            "Windows 10 Version 1607 for x64-based Systems",
            "Windows Server 2012",
            "Windows Server 2012 (Server Core installation)",
            "Windows Server 2012 R2",
            "Windows Server 2012 R2 (Server Core installation)",
            "Windows Server 2016",
            "Windows Server 2016 (Server Core installation)"
          ],
          "product": "Microsoft .NET Framework 4.8",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.4803.0",
              "status": "affected",
              "version": "4.8.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows 11 Version 26H1 for ARM64-based Systems",
            "Windows 11 version 26H1 for x64-based Systems"
          ],
          "product": "Microsoft .NET Framework 4.8.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "4.8.9340.0",
              "status": "affected",
              "version": "4.8.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Loop with unreachable exit condition (\u0027infinite loop\u0027) in Azure Active Directory allows an unauthorized attacker to deny service over a network."
    }
  ],
  "id": "CVE-2026-50653",
  "lastModified": "2026-07-22T16:18:07.847",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-50653",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-14T20:37:40.854539Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T17:17:01.790",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "secure@microsoft.com",
      "type": "Secondary"
    }
  ]
}

MSRC_CVE-2026-50653

Vulnerability from csaf_microsoft - Published: 2026-07-14 07:00 - Updated: 2026-07-14 07:00

Summary

Azure Active Directory Denial of Service Vulnerability

Severity

Important

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.

CVE-2026-50653

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Azure Active Directory 8.19.2 Azure Active Directory		8.19.2

Known affected 1 product

Product	Identifier	Version	Remediation
Azure Active Directory <8.19.2 Azure Active Directory		<8.19.2	Vendor Fix fix Vendor Fix fix Vendor Fix fix

Threats

Impact Denial of Service

Exploit Status Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely

References

7 references

URL	Category
https://msrc.microsoft.com/update-guide/vulnerabi…	self
https://msrc.microsoft.com/csaf/advisories/2026/m…	self
https://www.microsoft.com/en-us/msrc/exploitabili…	external
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/update-guide/vulnerabi…	self
https://msrc.microsoft.com/csaf/advisories/2026/m…	self

Acknowledgments

Sridhar Periyasamy

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Sridhar Periyasamy"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653"
      },
      {
        "category": "self",
        "summary": "CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-50653.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Azure Active Directory Denial of Service Vulnerability",
    "tracking": {
      "current_release_date": "2026-07-14T07:00:00.000Z",
      "generator": {
        "date": "2026-07-14T20:05:38.143Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-50653",
      "initial_release_date": "2026-07-14T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-07-14T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c8.19.2",
            "product": {
              "name": "Azure Active Directory \u003c8.19.2",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "8.19.2",
            "product": {
              "name": "Azure Active Directory 8.19.2",
              "product_id": "11963"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Active Directory"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-50653",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "11963"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653"
        },
        {
          "category": "self",
          "summary": "CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-50653.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-14T07:00:00.000Z",
          "details": "8.19.2:Security Update:https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md",
          "product_ids": [
            "1"
          ],
          "url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md"
        },
        {
          "category": "vendor_fix",
          "date": "2026-07-14T07:00:00.000Z",
          "details": "7.7.3:Security Update:https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md",
          "product_ids": [
            "1"
          ],
          "url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md"
        },
        {
          "category": "vendor_fix",
          "date": "2026-07-14T07:00:00.000Z",
          "details": "5.7.1:Security Update:https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md",
          "product_ids": [
            "1"
          ],
          "url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/CHANGELOG.md"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Denial of Service"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Azure Active Directory Denial of Service Vulnerability"
    }
  ]
}

NCSC-2026-0233

Vulnerability from csaf_ncscnl - Published: 2026-07-14 18:27 - Updated: 2026-07-14 18:27

Summary

Kwetsbaarheden verholpen in Microsoft Azure

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten: Microsoft heeft kwetsbaarheden verholpen in diverse Azure componenten.

Interpretaties: Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, beveiligingsmaatregelen te omzeilen of zich verhoogde rechten toe te kennen en zo mogelijk toegang te krijgen tot gegevens waartoe de kwaadwillende aanvankelijk niet is geautoriseerd. De ernstigste kwetsbaarheden bevonden zich in de OpenAI agent en Entra provisioning. Deze kwetsbaarheden zijn echter door Microsoft centraal reeds verholpen en slechts opgenomen ter informatie. Er zijn voor deze kwetsbaarheden geen acties vereist. ``` Azure CycleCloud: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-57969 | 8.80 | Verkrijgen van verhoogde rechten | | CVE-2026-58279 | 6.50 | Verkrijgen van verhoogde rechten | |----------------|------|-------------------------------------| Microsoft Entra Provisioning Service (SyncFabric): |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-57100 | 9.90 | Verkrijgen van verhoogde rechten | |----------------|------|-------------------------------------| Azure Monitor Agent: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-47632 | 8.80 | Verkrijgen van verhoogde rechten | |----------------|------|-------------------------------------| Azure Spring Apps: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-50338 | 8.20 | Verkrijgen van verhoogde rechten | |----------------|------|-------------------------------------| Azure Active Directory: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-50652 | 7.50 | Denial-of-Service | | CVE-2026-50653 | 7.50 | Denial-of-Service | |----------------|------|-------------------------------------| Azure OpenAI: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-45499 | 9.90 | Verkrijgen van verhoogde rechten | |----------------|------|-------------------------------------| Azure Synapse: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2026-26145 | 4.80 | Verkrijgen van verhoogde rechten | |----------------|------|-------------------------------------| ```

Oplossingen: Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op: https://portal.msrc.microsoft.com/en-us/security-guidance

Kans: medium

Schade: high

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-284: Improper Access Control

CWE-287: Improper Authentication

CWE-295: Improper Certificate Validation

CWE-306: Missing Authentication for Critical Function

CWE-400: Uncontrolled Resource Consumption

CWE-502: Deserialization of Untrusted Data

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

CWE-862: Missing Authorization

CWE-918: Server-Side Request Forgery (SSRF)

CVE-2026-26145

An improper access control vulnerability in Azure Synapse enables an authorized attacker to elevate privileges remotely over a network.

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

CVE-2026-45499

A server-side request forgery (SSRF) vulnerability in Azure OpenAI allows an authorized attacker to escalate privileges within the network, posing significant security risks.

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

CVE-2026-57100

A server-side request forgery (SSRF) vulnerability in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE-918 - Server-Side Request Forgery (SSRF)

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

CVE-2026-50338

Improper authentication in Azure Spring Apps enables an authorized attacker to elevate privileges over a network, posing a significant security risk.

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

CVE-2026-57969

A missing authentication vulnerability in Azure CycleCloud allows an authorized attacker to elevate privileges over a network, posing a critical security risk.

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-306 - Missing Authentication for Critical Function

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

CVE-2026-58279

A missing authorization vulnerability in Azure CycleCloud enables an authorized attacker to perform privilege escalation over a network.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C

CWE-862 - Missing Authorization

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

CVE-2026-47632

Improper certificate validation in the Azure Monitor Agent allows an unauthorized attacker on an adjacent network to elevate privileges, posing a significant security risk.

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-295 - Improper Certificate Validation

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

CVE-2026-50652

A deserialization vulnerability in Azure Active Directory allows an unauthorized attacker to cause a denial of service over a network by processing untrusted data.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

CWE-502 - Deserialization of Untrusted Data

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

CVE-2026-50653

An infinite loop vulnerability in Azure Active Directory allows unauthorized attackers to cause a network-based denial of service by exploiting an unreachable exit condition.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Known affected 10 products

Product	Identifier	Version	Remediation
vers:unknown/* Microsoft / Azure		vers:unknown/*
vers:unknown/* Microsoft / Azure Active Directory		vers:unknown/*
vers:unknown/* Microsoft / Azure CycleCloud 8.9.1		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Linux Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Monitor Agent Metrics Extension		vers:unknown/*
vers:unknown/* Microsoft / Azure Open AI		vers:unknown/*
vers:unknown/* Microsoft / Azure Spring Apps		vers:unknown/*
vers:unknown/* Microsoft / Azure Synapse		vers:unknown/*
vers:unknown/* Microsoft / Entra		vers:unknown/*
vers:unknown/* Microsoft / Microsoft Entra Provisioning Service		vers:unknown/*

References

9 references

URL	Category
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Microsoft heeft kwetsbaarheden verholpen in diverse Azure componenten.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, beveiligingsmaatregelen te omzeilen of zich verhoogde rechten toe te kennen en zo mogelijk toegang te krijgen tot gegevens waartoe de kwaadwillende aanvankelijk niet is geautoriseerd.\n\nDe ernstigste kwetsbaarheden bevonden zich in de OpenAI agent en Entra provisioning. Deze kwetsbaarheden zijn echter door Microsoft centraal reeds verholpen en slechts opgenomen ter informatie. Er zijn voor deze kwetsbaarheden geen acties vereist.\n\n```\nAzure CycleCloud: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2026-57969 | 8.80 | Verkrijgen van verhoogde rechten    | \n| CVE-2026-58279 | 6.50 | Verkrijgen van verhoogde rechten    | \n|----------------|------|-------------------------------------|\n\nMicrosoft Entra Provisioning Service (SyncFabric): \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2026-57100 | 9.90 | Verkrijgen van verhoogde rechten    | \n|----------------|------|-------------------------------------|\n\nAzure Monitor Agent: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2026-47632 | 8.80 | Verkrijgen van verhoogde rechten    | \n|----------------|------|-------------------------------------|\n\nAzure Spring Apps: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2026-50338 | 8.20 | Verkrijgen van verhoogde rechten    | \n|----------------|------|-------------------------------------|\n\nAzure Active Directory: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2026-50652 | 7.50 | Denial-of-Service                   | \n| CVE-2026-50653 | 7.50 | Denial-of-Service                   | \n|----------------|------|-------------------------------------|\n\nAzure OpenAI: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2026-45499 | 9.90 | Verkrijgen van verhoogde rechten    | \n|----------------|------|-------------------------------------|\n\nAzure Synapse: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2026-26145 | 4.80 | Verkrijgen van verhoogde rechten    | \n|----------------|------|-------------------------------------|\n```",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:\n\nhttps://portal.msrc.microsoft.com/en-us/security-guidance",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
        "title": "CWE-77"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Improper Certificate Validation",
        "title": "CWE-295"
      },
      {
        "category": "general",
        "text": "Missing Authentication for Critical Function",
        "title": "CWE-306"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
        "title": "CWE-835"
      },
      {
        "category": "general",
        "text": "Missing Authorization",
        "title": "CWE-862"
      },
      {
        "category": "general",
        "text": "Server-Side Request Forgery (SSRF)",
        "title": "CWE-918"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "title": "Kwetsbaarheden verholpen in Microsoft Azure",
    "tracking": {
      "current_release_date": "2026-07-14T18:27:21.338576Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0233",
      "initial_release_date": "2026-07-14T18:27:21.338576Z",
      "revision_history": [
        {
          "date": "2026-07-14T18:27:21.338576Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Active Directory"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure CycleCloud 8.9.1"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Monitor Agent Linux Extension"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-5"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Monitor Agent Metrics Extension"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-6"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Open AI"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-7"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Spring Apps"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-8"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Synapse"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-9"
                }
              }
            ],
            "category": "product_name",
            "name": "Entra"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-10"
                }
              }
            ],
            "category": "product_name",
            "name": "Microsoft Entra Provisioning Service"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-26145",
      "notes": [
        {
          "category": "description",
          "text": "An improper access control vulnerability in Azure Synapse enables an authorized attacker to elevate privileges remotely over a network.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-26145 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-26145.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-26145"
    },
    {
      "cve": "CVE-2026-45499",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        },
        {
          "category": "description",
          "text": "A server-side request forgery (SSRF) vulnerability in Azure OpenAI allows an authorized attacker to escalate privileges within the network, posing significant security risks.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-45499 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45499.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-45499"
    },
    {
      "cve": "CVE-2026-57100",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        },
        {
          "category": "description",
          "text": "A server-side request forgery (SSRF) vulnerability in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-57100 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57100.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-57100"
    },
    {
      "cve": "CVE-2026-50338",
      "notes": [
        {
          "category": "description",
          "text": "Improper authentication in Azure Spring Apps enables an authorized attacker to elevate privileges over a network, posing a significant security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-50338 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-50338.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-50338"
    },
    {
      "cve": "CVE-2026-57969",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authentication for Critical Function",
          "title": "CWE-306"
        },
        {
          "category": "description",
          "text": "A missing authentication vulnerability in Azure CycleCloud allows an authorized attacker to elevate privileges over a network, posing a critical security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-57969 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57969.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-57969"
    },
    {
      "cve": "CVE-2026-58279",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authorization",
          "title": "CWE-862"
        },
        {
          "category": "description",
          "text": "A missing authorization vulnerability in Azure CycleCloud enables an authorized attacker to perform privilege escalation over a network.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-58279 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58279.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-58279"
    },
    {
      "cve": "CVE-2026-47632",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "Improper certificate validation in the Azure Monitor Agent allows an unauthorized attacker on an adjacent network to elevate privileges, posing a significant security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-47632 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47632.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-47632"
    },
    {
      "cve": "CVE-2026-50652",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        },
        {
          "category": "description",
          "text": "A deserialization vulnerability in Azure Active Directory allows an unauthorized attacker to cause a denial of service over a network by processing untrusted data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-50652 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-50652.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-50652"
    },
    {
      "cve": "CVE-2026-50653",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
          "title": "CWE-835"
        },
        {
          "category": "description",
          "text": "An infinite loop vulnerability in Azure Active Directory allows unauthorized attackers to cause a network-based denial of service by exploiting an unreachable exit condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-50653 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-50653.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10"
          ]
        }
      ],
      "title": "CVE-2026-50653"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-50653 (GCVE-0-2026-50653)

CERTFR-2026-AVI-0871

Solutions

FKIE_CVE-2026-50653

MSRC_CVE-2026-50653

NCSC-2026-0233

Tags

Sightings

Nomenclature