EUVD-2026-25416
GHSA-wf2v-9gjv-6gv6
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Azure IoT Central enables authenticated attackers to gain unauthorized access to sensitive information and elevate their permissions across tenant boundaries. An attacker with low-privilege credentials can exploit exposed sensitive data over the network to compromise confidentiality, integrity, and availability of other tenant resources. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Azure IoT Central deployments and identify users with low-privilege roles (Operator, Viewer, or equivalent). Verify role-based access control (RBAC) assignments and document all cross-tenant access patterns. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap
Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perfo
The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such a
Use after free in Views in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromise
Share
External POC / Exploit Code
Leaving vuln.today