Technical impact
The vulnerability is a flaw in deserialization of untrusted data that can be exploited by an attacker to trigger a denial of service in Azure Active Directory. The improper validation of input during object deserialization constitutes a CWE-502 weakness. An attacker who can send malicious data to the relevant endpoint can cause the service to become unavailable, potentially disrupting authentication and authorization for all users relying on Azure AD.
Affected Systems
Affected systems include Microsoft Azure Active Directory and multiple Microsoft .NET Framework releases: 3.5; 3.5 combined with 4.7.2; 3.5 combined with 4.8; 3.5 combined with 4.8.1; 4.6.2, 4.7, 4.7.1, and 4.7.2; and 4.8. These versions may process untrusted data deserialization without proper checks, exposing the vulnerability.
Risk and Exploitability
With a CVSS score of 7.5 the vulnerability is classified as high severity, indicating that exploitation could severely disrupt service availability. The EPSS score of 1% suggests a low but non‑zero probability that attackers attempt exploitation, and the vulnerability is not currently listed in CISA's KEV catalog. Based on the description, the flaw involves deserialization of untrusted data, so the likely attack vector is an external actor transmitting crafted data to an Azure AD endpoint that performs deserialization. If successful, this could cause a denial of service affecting authentication flows for all users of the exposed Azure AD instance.
