Executive brief
Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management service used by organizations to authenticate and authorize users and applications. A deserialization vulnerability allows an unauthenticated attacker to execute arbitrary code remotely on systems running this service, potentially compromising user credentials, access tokens, and organizational security infrastructure.
Technical details
The vulnerability is a deserialization-of-untrusted-data flaw in Microsoft Entra ID that permits remote code execution (RCE) without requiring prior authentication. The attacker can send a specially crafted network request containing malicious serialized objects to the affected service, which deserializes the data without proper validation. This allows arbitrary code execution in the context of the Entra ID service. The attack vector is network-based and no user interaction or authentication is required, making it highly exploitable. Patches are expected to be released via Microsoft Security Update Guide.
Affected products
- Microsoft Entra ID
Timeline
- 2026-08-20: disclosed