PatchaPalooza

CVE-2026-50481: Azure Active Directory Elevation of Privilege Vulnerability

CVE-2026-50481 is an elevation of privilege vulnerability in Azure Active Directory, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.9 (Critical). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.82% probability of exploitation activity in the next 30 days, higher than 58% of all scored vulnerabilities. Microsoft published it on 6 August 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Azure).

Key facts

CVE ID
CVE-2026-50481
Severity
Critical CVSS 9.9
Microsoft severity
Critical
Impact
Elevation of Privilege
Exploited in the wild
No
Publicly disclosed
No
Weakness
CWE-471
EPSS
0.82% (percentile 58%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
August 2026 Patch Tuesday
Product families
Azure

CVSS score and vector

Microsoft scores CVE-2026-50481 at 9.9 (temporal 8.6) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactLow
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

Affected products (1)

Azure

ProductSecurity updateTypeFixed buildRestart
Azure Active Directory

NIST NVD data

NVD status
Analyzed
NVD CVSS
9.9 (CRITICAL)
NVD weakness
CWE-471
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
azure active directoryall listed versions

References

Acknowledgments

  • Anonymous

Revision history

VersionDateDescription
1.0Information published.

Sources