CVE-2021-36949

HIGH 7.1CVE-2021-36949 · Published 12/08/2021 · updated 10/08/2026

In short

CVE-2021-36949 is a HIGH (CVSS 7.1) vulnerability affecting azure active directory connect (microsoft), azure active directory connect provisioning agent (microsoft).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.6% of all vulnerabilities.
Fix: update to 1.1.582.0 or later.

Package	Affected versions	Patched versions
azure active directory connect microsoft	`≥ 1.3.20.0, ≤ 1.6.11.3≥ 2.0.3.0, ≤ 2.0.9.0`	No fix yet
azure active directory connect provisioning agent microsoft	`< 1.1.582.0`	`1.1.582.0`

Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability

Running one of these products? Scan your site to see whether it exposes a vulnerable version.