PT-2026-60486

Name of the Vulnerable Software and Affected Versions Microsoft Office 365 Integration plugin versions prior to 4.5.6 Microsoft Office 365 Integration plugin versions prior to 5.0.5 Microsoft Office 365 Integration plugin versions prior to 5.1.1 Description The Microsoft Office 365 Integration...

BIT-PROMETHEUS-2026-42151 Prometheus Azure AD remote write OAuth client secret exposed via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the clientsecret field in the Azure AD remote write OAuth configuration storage/remote/azuread was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving...

CVE-2026-50652

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-50653

Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-50653

Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability

...

CVE-2026-50653 Azure Active Directory Denial of Service Vulnerability

...

CVE-2026-50653

CVE-2026-50653 describes an infinite loop with an unreachable exit condition in Azure Active Directory that can allow a network-based denial of service. The provided documents confirm the issue and its impact as a denial of service via network, but do not include specific exploitation details, af...

CVE-2026-50652

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-50652 Azure Active Directory Denial of Service Vulnerability

...

CVE-2026-50652 Azure Active Directory Denial of Service Vulnerability

...

CVE-2026-50652

CVE-2026-50652: A deserialization of untrusted data flaw in Azure Active Directory enables a network-based Denial of Service. The vulnerability is triggered remotely (network vector), requires no authentication and no user interaction, and results in availability impact (A:H) with no confidential...

Azure Active Directory Denial of Service Vulnerability

Loop with unreachable exit condition 'infinite loop' in Azure Active Directory allows an unauthorized attacker to deny service over a network...

Azure Active Directory Denial of Service Vulnerability

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

PT-2026-58210

Name of the Vulnerable Software and Affected Versions Azure Active Directory versions prior to 8.19.2 Description An infinite loop occurs when an unreachable exit condition is triggered, allowing an unauthorized attacker to remotely cause a denial of service over a network. Recommendations Update...

KLA91142 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Monitor Agent Metri...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

CVE-2026-52783

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...

CVE-2026-52783

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth accesstoken plaintext to Rails.cache under the deterministic key storage..httpxaccesstoken, repopulated continuously by an...

GO-2026-5710 Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus

Prometheus Azure AD remote write OAuth client secret exposed via config API in github.com/prometheus/prometheus...