{
"document": {
"acknowledgments": [
{
"names": [
"Sagi Sheinfeld with Crowdstrike"
]
},
{
"names": [
"Eyal Karni with Crowdstrike"
]
},
{
"names": [
"Yaron Zinar with CrowdStrike"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2021-36949 Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36949"
},
{
"category": "self",
"summary": "CVE-2021-36949 Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/advisories/2021/msrc_cve-2021-36949.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability",
"tracking": {
"current_release_date": "2021-08-10T07:00:00.000Z",
"generator": {
"date": "2026-08-10T15:09:50.414Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2021-36949",
"initial_release_date": "2021-08-10T07:00:00.000Z",
"revision_history": [
{
"date": "2021-08-10T07:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
},
{
"date": "2021-08-10T07:00:00.000Z",
"legacy_version": "2",
"number": "2",
"summary": "The following revisions have been made: 1) In the Security Updates table, added Azure Active Directory Connect Provisioning Agent as it is also affected by this vulnerability 2) Updated FAQs."
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "<1.6.11.3",
"product": {
"name": "Microsoft Azure Active Directory Connect 1.X.Y.Z <1.6.11.3",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "1.6.11.3",
"product": {
"name": "Microsoft Azure Active Directory Connect 1.X.Y.Z 1.6.11.3",
"product_id": "11920"
}
}
],
"category": "product_name",
"name": "Microsoft Azure Active Directory Connect 1.X.Y.Z"
},
{
"branches": [
{
"category": "product_version_range",
"name": "<1.1.582.0",
"product": {
"name": "Azure Active Directory Connect Provisioning Agent <1.1.582.0",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "1.1.582.0",
"product": {
"name": "Azure Active Directory Connect Provisioning Agent 1.1.582.0",
"product_id": "11922"
}
}
],
"category": "product_name",
"name": "Azure Active Directory Connect Provisioning Agent"
},
{
"branches": [
{
"category": "product_version_range",
"name": "<2.0.8.0",
"product": {
"name": "Microsoft Azure Active Directory Connect 2.0.X.Y <2.0.8.0",
"product_id": "3"
}
},
{
"category": "product_version",
"name": "2.0.8.0",
"product": {
"name": "Microsoft Azure Active Directory Connect 2.0.X.Y 2.0.8.0",
"product_id": "11919"
}
}
],
"category": "product_name",
"name": "Microsoft Azure Active Directory Connect 2.0.X.Y"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-36949",
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "In addition to applying the updates in this CVE, you will need to disable NTLM as per the guidance as follows:\nFor Azure Active Directory Connect, see Prerequisites for Azure AD Connect\nFor Azure Active Directory Connect Provisioning Agent, see Prerequisites for Azure AD Connect cloud sync\nThe attacker must be able to establish Man-in-the-middle between your Azure AD Connect server and a domain controller. The attacker also needs to possess domain user credentials to be able to exploit this vulnerability.",
"title": "What should I do to be protected against this vulnerability?"
}
],
"product_status": {
"fixed": [
"11919",
"11920",
"11922"
],
"known_affected": [
"1",
"2",
"3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2021-36949 Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36949"
},
{
"category": "self",
"summary": "CVE-2021-36949 Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/advisories/2021/msrc_cve-2021-36949.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2021-08-10T07:00:00.000Z",
"details": "1.6.11.3:Security Update:https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-version-history",
"product_ids": [
"2"
],
"url": "https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-version-history"
},
{
"category": "vendor_fix",
"date": "2021-08-10T07:00:00.000Z",
"details": "1.1.582.0:Security Update:https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/provisioning-agent-release-version-history#115820",
"product_ids": [
"1"
],
"url": "https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/provisioning-agent-release-version-history#115820"
},
{
"category": "vendor_fix",
"date": "2021-08-10T07:00:00.000Z",
"details": "2.0.8.0:Security Update:https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-version-history",
"product_ids": [
"3"
],
"url": "https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-version-history"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 0.0,
"exploitCodeMaturity": "PROOF_OF_CONCEPT",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.4,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Elevation of Privilege"
},
{
"category": "exploit_status",
"details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely"
}
],
"title": "Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability"
}
]
}