This vulnerability (CVE-2026-50652) in Microsoft Azure Active Directory is due to deserialization of untrusted data (CWE-502). It allows an attacker without privileges or user interaction to cause a denial of service condition remotely. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. The vulnerability affects the 2021 version of Azure Active Directory. Microsoft has released an official fix and manages patching for this cloud service. No active exploitation has been reported.

An unauthorized attacker can remotely cause a denial of service in Azure Active Directory by exploiting the deserialization vulnerability. There is no impact on confidentiality or integrity, only availability is affected. This could disrupt authentication or directory services relying on Azure AD.

Microsoft has provided an official fix for this vulnerability and manages remediation for Azure Active Directory as a cloud service. Customers should ensure their Azure AD service is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50652. No additional customer action is typically required beyond applying the official fix.