379 matches found
EUVD-2026-54315
Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-50481
Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-50481
Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability
...
CVE-2026-50481
CVE-2026-50481 affects Azure Active Directory, where modification of assumed-immutable data (maid) enables an authorized attacker to elevate privileges over a network. The CVSS data indicates NETWORK attack vector, LOW access complexity, LOW privileges required, and HIGH confidentiality/integrity...
CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability
...
KLA91190 Multiple vulnerabilities in Microsoft Azure
Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...
CVE-2026-59243
The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...
CVE-2026-59243
The CVE-2026-59243 vulnerability affects the apache-airflow-providers-fab package before 3.7.3, where the FAB auth manager’s Azure AD OAuth login defaulted verify_signature=False when decoding the ID token. An attacker who can present a forged or unsigned (alg:none) ID token to the OAuth callback...
EUVD-2026-50216
The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...
PT-2026-60486
Name of the Vulnerable Software and Affected Versions Microsoft Office 365 Integration plugin versions prior to 4.5.6 Microsoft Office 365 Integration plugin versions prior to 5.0.5 Microsoft Office 365 Integration plugin versions prior to 5.1.1 Description The Microsoft Office 365 Integration...
BIT-PROMETHEUS-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...
CVE-2026-50652
Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...
CVE-2026-50653
Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...
CVE-2026-50653
Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...
CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability
...
CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability
...
CVE-2026-50653
CVE-2026-50653 describes an infinite loop with an unreachable exit condition in Azure Active Directory that can allow a network-based denial of service. The provided documents confirm the issue and its impact as a denial of service via network, but do not include specific exploitation details, af...
CVE-2026-50652 Azure Active Directory Denial of Service Vulnerability
...
CVE-2026-50652
CVE-2026-50652: A deserialization of untrusted data flaw in Azure Active Directory enables a network-based Denial of Service. The vulnerability is triggered remotely (network vector), requires no authentication and no user interaction, and results in availability impact (A:H) with no confidential...