Azure Event Grid CVE-2025-59273

The vulnerability resides in the Microsoft-managed Azure Event Grid service; per CVSS PR:N/UI:N/AC:L, exploitation is described as network-reachable by an unauthorized attacker with no authentication or user interaction and low complexity against the service's access-control logic. The primary limiting factor is the deployment model: Event Grid is a cloud PaaS offering, so remediation is applied centrally by Microsoft rather than by customers, substantially narrowing the real-world window of exposure. The description does not name a specific feature flag or non-default configuration as a prerequisite; however, because the flaw is a privilege-elevation issue ('elevate privileges'), the exact starting trust level required is ambiguous in the available data and should be verified via the MSRC advisory.

Signals are sharply conflicting. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H) paints a worst-case picture: network-reachable, low-complexity, no privileges or user interaction, full confidentiality/integrity/availability impact. However, the EPSS score is only 0.38% (30th percentile), indicating low modeled probability of exploitation in the near term, and there is no CISA KEV listing and no public exploit identified at time of analysis - so there is no evidence of active exploitation or weaponization. A critical mitigating factor the raw score ignores: Azure Event Grid is a Microsoft-operated cloud (PaaS) service, so the fix is deployed server-side by Microsoft and customers do not self-patch; the exposure window for most tenants is therefore controlled by Microsoft's remediation rather than customer action. Net assessment: this is a genuinely high-severity access-control/privilege-elevation flaw worth tracking, but the combination of low EPSS, no KEV, no POC, and vendor-managed remediation means it is not currently an active-exploitation emergency. The description ('improper access control ... elevate privileges') is terse and does not specify the exact trust boundary crossed; the PR:N (unauthenticated) rating should be verified against Microsoft's MSRC advisory, as privilege-elevation flaws sometimes require some pre-existing authenticated foothold.

A remote attacker sends crafted requests to the Azure Event Grid service exploiting an improper access-control check, bypassing authorization boundaries to gain privileges they should not hold over resources or event data belonging to other principals. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) this requires only network access with low complexity and no authentication or user interaction. No public proof-of-concept exploit has been identified at time of analysis.