Microsoft Azure Active Directory Connect vulnerabilities

3 CVEs affecting Microsoft Azure Active Directory Connect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-36949, published 2021-08-12.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-8613, published 2017-06-29. High severity, CVSS 8.1. EPSS: 3.7% chance of exploitation in the next 30 days. Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka…
• CVE-2019-1000, published 2019-05-16. Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Microsoft Azure Active Directory Connect build 1.3.20.0, which allows an attacker to execute two PowerShell cmdlets in context of a privileged…
• CVE-2021-36949, published 2021-08-12. High severity, CVSS 7.1. EPSS: 1.4% chance of exploitation in the next 30 days. Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability