Microsoft Azure Active Directory vulnerabilities

CVE-2026-45480 [CRITICAL] CWE-287 CVE-2026-45480: Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privile Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-50481 [CRITICAL] CWE-471 CVE-2026-50481: Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacke Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

CVE-2026-50652 [HIGH] CWE-502 CVE-2026-50652: Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

CVE-2026-50653 [HIGH] CWE-400 CVE-2026-50653: Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthori Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

CVE-2021-42306 [MEDIUM] CWE-522 CVE-2021-42306: An information disclosure vulnerability manifests when a user or an application uploads unprotected An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential on an Azure AD Application or Service Principal (which is not recommended). This vulnerability allows a user or service in the tenant with application read access to read the priva