CVE-2024-21381: Microsoft azure active directory cross-site request forgery vulnerability

Microsoft · Azure Active Directory

Microsoft Azure Active Directory B2C Spoofing Vulnerability

6.8 CVSS 3.1 Medium EPSS 0.42% · top 66.1% CWE-352 · Cross-site request forgery

6.8CVSS 3.1 base score

0.42%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

10 Aug 2026Last modified by NVD

Description

Microsoft Azure Active Directory B2C Spoofing Vulnerability

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Azure Active Directory Microsoft

References

Link	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21381	PatchVendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21381	PatchVendor Advisory

Track CVE-2024-21381 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-45480Microsoft azure active directory improper authentication vulnerabilityImproper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.EPSS 0.90%19 Jun 2026 9.9CVE-2026-50481Microsoft azure active directory vulnerabilityModification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.EPSS 0.82%7 Aug 2026 8.1CVE-2021-42306Microsoft azure active directory insufficiently protected credentials vulnerabilityAn information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication cer…EPSS 3.3%24 Nov 2021 7.5CVE-2026-50652Microsoft .net framework deserialization of untrusted data vulnerabilityDeserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.EPSS 1.7%14 Jul 2026 7.5CVE-2026-50653Microsoft .net framework uncontrolled resource consumption vulnerabilityLoop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.EPSS 1.2%14 Jul 2026 9.4CVE-2025-62593Ray browser-based RCE via insufficient User-Agent guardRay, an AI compute engine, contains a critical remote code execution flaw before version 2.52.0. Its defense against browser-based attacks relies on …KEVEPSS 62%analysed26 Nov 2025 8.1CVE-2008-4128Cisco IOS HTTP Administration CSRF allows arbitrary command executionThe HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router is vulnerable to multiple cross-site request forgery flaws.…KEVEPSS 34%analysed18 Sep 2008 8.8CVE-2023-2533PaperCut NG/MF CSRF allows admin security setting changes and code executionPaperCut NG and MF contain a cross-site request forgery flaw that, under specific conditions, lets an attacker change security settings or execute ar…KEVEPSS 29%analysed20 Jun 2023

Source: NIST National Vulnerability Database (record CVE-2024-21381), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.