Microsoft has disclosed a critical privilege escalation flaw in Azure Active Directory that lets an already-authenticated attacker with low privileges elevate over the network and break out of their original security scope.
What Is It
CVE-2026-50481 is a modification of assumed-immutable data (MAID) vulnerability in Azure Active Directory, tracked as CWE-471. Per Microsoft's advisory, the flaw "allows an authorized attacker to elevate privileges over a network."
The CVSS 3.1 base score is 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. The breakdown matters here: network attack vector, low attack complexity, low privileges required, and no user interaction; with a changed scope, meaning the impact extends beyond the component the attacker initially compromised. Confidentiality and integrity impacts are both HIGH; availability impact is LOW.
Why It Matters
The combination of low privileges required, no user interaction, and scope change is what pushes this to 9.9. Any principal that can already authenticate to the tenant is a potential starting point, and the exploitability subscore of 3.1 (out of a 3.9 maximum) reflects how few barriers stand between that starting point and escalation.
CVE-2026-50481 is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no evidence of active exploitation was present in the supplied source material.
What's Vulnerable
Microsoft Azure Active Directory. The NVD record lists the affected version as -, and Microsoft has tagged the CVE exclusively-hosted-service, this is a cloud service vulnerability, not an on-premises product with a version range. No affected CPEs are enumerated in the record.
Patch Status
Because this is an exclusively-hosted-service issue, remediation is handled by Microsoft on the service side rather than through customer-applied patches. No customer action or required-action deadline is specified in the supplied source material. The NVD record was published 2026-08-07 with a vulnStatus of "Received," meaning NVD analysis is not yet complete. Consult the MSRC update guide entry below for Microsoft's authoritative remediation statement.
Sources
- NVD, CVE-2026-50481: https://nvd.nist.gov/vuln/detail/CVE-2026-50481
- Microsoft MSRC Update Guide; CVE-2026-50481: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50481