HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2026-50652

CVSS 7.5v3.1pub. 2026-07-14upd. 2026-07-24

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Microsoft Azure Active Directory
APP
Microsoft
all versions
Microsoft .net Framework
APP
Microsoft
3.54.6.24.74.7.14.7.24.84.8.1
Microsoft Windows 10 1607
OS
Microsoft
all versions
Microsoft Windows 10 1809
OS
Microsoft
all versions
Microsoft Windows 10 21h2
OS
Microsoft
all versions
Microsoft Windows 10 22h2
OS
Microsoft
all versions
Microsoft Windows 11 23h2
OS
Microsoft
all versions
Microsoft Windows 11 24h2
OS
Microsoft
all versions
Microsoft Windows 11 25h2
OS
Microsoft
all versions
Microsoft Windows 11 26h1
OS
Microsoft
all versions
Microsoft Windows Server 2012
OS
Microsoft
r2
Microsoft Windows Server 2016
OS
Microsoft
all versions
Microsoft Windows Server 2019
OS
Microsoft
all versions
Microsoft Windows Server 2022
OS
Microsoft
all versions

🟢

PATCH AVAILABLE

Vendor update available. Deploy in standard maintenance cycle.

Tags

Deserialization

CWE

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-…

Related vulnerabilities

CVE-2026-33824CRITICAL9.8⚠ KEVPL ✓same product

Double free w Windows IKE Extension umożliwia zdalne wykonanie kodu

CVE-2025-59287CRITICAL9.8⚠ KEVPL ✓same product

RCE w Windows Server Update Service (WSUS) — deserializacja danych

CVE-2020-1040CRITICAL9.0⚠ KEVPL ✓same product

RCE w Hyper-V RemoteFX vGPU — błąd walidacji wejścia od gościa

CVE-2020-1350CRITICAL10.0⚠ KEVPL ✓same product

RCE w Windows DNS Server — krytyczna podatność SIGRed (CVSS 10.0)

CVE-2020-0646CRITICAL9.8⚠ KEVPL ✓same product

RCE w Microsoft .NET Framework — nieprawidłowa walidacja danych wejściowych