Azure Active Directory Denial of Service Vulnerability

CVE-2026-50653 is a denial of service vulnerability in Azure Active Directory (rated Important, CVSS 7.5).

1 version

Microsoft id: CVE-2026-50653
Products: Azure Active Directory
Severity: Important
Impact: Denial of Service
CVSS: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Customer action required: Yes
Release: 2026-Jul
Assigned by: Microsoft
Weakness: CWE-400: Uncontrolled Resource Consumption, CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
MSRC revision: 4.0
Status pages: Microsoft Entra ID status
First captured by us: 13 Nov 2026, 15:55 UTC (from our first import of this list)
Microsoft last modified: 21 Jul 2026, 14:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

Revision 1.0, 2026-07-14: Information published.
Revision 2.0, 2026-07-16: Updated product information in the Software Update table. This is an informational change only.
Revision 3.0, 2026-07-20: Updated product information in the Software Update table. This is an informational change only.
Revision 4.0, 2026-07-21: Updated product information in the Software Update table. This is an informational change only.

Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

Security updates, 14:00 UTC, 21 Jul

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 15:55 UTC, 13 Nov
The text as we first saw it
Seen by us 15:55 UTC, 13 Nov · Microsoft's timestamp 14:00 UTC, 21 Jul · Microsoft's page

Last updated 13 Nov 2026, 15:55 UTC