What’s Vulnerable › Vulnerabilities

CVE-2024-35255: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-11 · updated 2026-08-10
• Weakness: CWE-362

Description

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Affected products

• Microsoft Authentication Library (MSAL) for Android: before 1.15.1; through 2.9.2; before 4.61.3 — fixed in 1.15.1, 4.61.3
• Microsoft Azure Identity SDK for .NET: before 1.6.0; before 1.8.0; before 1.11.4; before 1.12.2; before 1.16.1; before 4.2.1 — fixed in 1.11.4, 1.12.2, 1.16.1, 1.6.0, 1.8.0, 4.2.1
• Microsoft Authentication Library (MSAL) for Android: from 1.0.0 before 1.15.1 — fixed in 1.15.1
• Microsoft Azure Identity Library for .NET: from 1.0.0 before 1.11.4 — fixed in 1.11.4
• Microsoft Azure Identity Library: from 1.0.0 before 1.6.0 — fixed in 1.6.0
• Microsoft Azure Identity Library for C++: from 1.0.0 before 1.8.0 — fixed in 1.8.0
• Microsoft Azure Identity Library for Java: from 1.0.0 before 1.12.2 — fixed in 1.12.2
• Microsoft Azure Identity Library for JavaScript: from 1.0.0 before 4.2.1 — fixed in 4.2.1
• Microsoft Azure Identity Library for Python: from 1.0.0 before 1.16.1 — fixed in 1.16.1

How to fix

Upgrade to a fixed version: Microsoft Authentication Library (MSAL) for Android 1.15.1, 4.61.3; Microsoft Azure Identity SDK for .NET 1.11.4, 1.12.2, 1.16.1, 1.6.0; Microsoft Authentication Library (MSAL) for Android 1.15.1; Microsoft Azure Identity Library for .NET 1.11.4; Microsoft Azure Identity Library 1.6.0; Microsoft Azure Identity Library for C++ 1.8.0; Microsoft Azure Identity Library for Java 1.12.2; Microsoft Azure Identity Library for JavaScript 4.2.1; Microsoft Azure Identity Library for Python 1.16.1. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255

Get alerted when CVE-2024-35255 or the next vulnerability affects your stack