CVE-2017-8613

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-29 · updated 2026-06-17
Weakness: CWE-640

Description

Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege Vulnerability."

Affected products

Microsoft Corporation Azure AD Connect: through 1.1.524.0
Microsoft Corporation Azure AD Connect: Azure AD Connect versions prior to version 1.1.553.0

References

http://www.securityfocus.com/bid/99294
https://technet.microsoft.com/library/security/4033453
http://www.securityfocus.com/bid/99294
https://technet.microsoft.com/library/security/4033453

Get alerted when CVE-2017-8613 or the next vulnerability affects your stack