Azure Notification Service CVE-2025-59500

Exploitation requires the attacker to already be an authorized principal against Azure Notification Service (CVSS PR:L) - it is NOT remote-unauthenticated; the improper access-control defect lets that low-privileged, authenticated actor bypass authorization boundaries to elevate privileges over the network. No user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factor is the authorization prerequisite: an attacker with zero valid access cannot exploit this. Because Azure Notification Service is a Microsoft-hosted cloud service, remediation is applied server-side by Microsoft rather than requiring customer action, which further limits the practical exposure window.

The CVSS 3.1 base score of 8.8 (HIGH) is driven by a network attack vector (AV:N), low complexity (AC:L), no user interaction (UI:N), and full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), tempered only by the requirement for low-level privileges (PR:L) - meaning the attacker must already be an authorized principal, not an anonymous outsider. The EPSS score is low at 0.55% (44th percentile), indicating no statistical signal of imminent mass exploitation, and the vulnerability is NOT listed in CISA KEV, with no public proof-of-concept identified - so despite the high CVSS, the real-world urgency signals are muted. These signals are consistent rather than conflicting: a high-impact but privilege-gated flaw in a Microsoft-managed cloud service that Microsoft remediates server-side. A key caveat: Azure Notification Service is a hosted Azure offering, so the fix is applied by Microsoft in the cloud rather than requiring customer patching; the SSVC/technical-impact picture suggests total control once the PR:L precondition is met, but automatability is unclear and there is no evidence of active exploitation. Net assessment: a genuine high-severity privilege-escalation issue worth tracking, but currently lower operational priority than its 8.8 score alone implies, given the absence of KEV/POC, low EPSS, and the authorization prerequisite.

An attacker who already holds a low-privileged but authorized role against Azure Notification Service sends crafted requests over the network that exploit the improper access-control check (CWE-284), escalating to higher privileges and gaining full read/write/availability control over the targeted resources. No user interaction is required and attack complexity is low (AC:L), but the attacker must first possess valid low-level authorization (PR:L). No public exploit identified at time of analysis.