What is the CVSS score of CVE-2026-32171?

CVE-2026-32171 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-32171?

Azure Logic Apps contains a credential protection weakness (CVE-2026-32171, CVSS 8.8) that allows authenticated users to escalate privileges and access sensitive integration credentials stored within…. A patch is available.

How to fix or mitigate CVE-2026-32171?

Within 24 hours: Identify all Azure Logic Apps instances in your environment and document which service principals or user accounts have access. Within 7 days: Apply the vendor-released patch to all affected Logic Apps instances and validate deployments in a test environment first. Within 30 days: Audit Logic Apps credential usage logs, rotate all credentials managed through Logic Apps, and implement least-privilege access controls limiting who can view or manage stored credentials.

Microsoft CVE-2026-32171

EUVD-2026-22560 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-04-14 microsoft

GHSA-jw55-vf6x-jr62

Information Disclosure Microsoft

8.8

CVSS 3.1 · NVD

Temporal: 7.7

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:34 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22560

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 8.8

DescriptionCVE.org

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Azure Logic Apps fails to adequately protect stored credentials, enabling authenticated attackers with network access to escalate privileges and gain unauthorized access to sensitive data. With a CVSS score of 8.8 and low attack complexity (AC:L), this vulnerability poses significant risk to cloud environments where Logic Apps handle integration credentials. Microsoft has released a patch addressing the credential protection weakness. No public exploit identified at time of analysis, though the low complexity suggests straightforward exploitation once authentication is obtained.

Technical ContextAI

Azure Logic Apps is Microsoft's cloud-based integration platform-as-a-service (iPaaS) that orchestrates workflows between applications, data sources, and services. This vulnerability stems from CWE-522 (Insufficiently Protected Credentials), indicating that authentication credentials - likely connection strings, API keys, or service principal secrets used by Logic Apps to authenticate to external services - are stored, transmitted, or exposed without adequate cryptographic protection or access controls. The affected CPE (cpe:2.3:a:microsoft:azure_logic_apps) encompasses the entire Azure Logic Apps service platform. The insufficient protection could manifest through inadequate encryption at rest, exposure in logs or diagnostic outputs, insufficient access controls on credential stores, or leakage through API responses. The vulnerability requires low-privilege authentication (PR:L), suggesting any authenticated Azure user with basic access to Logic Apps resources could potentially access protected credentials belonging to other workflows or tenants.

RemediationAI

Apply the vendor-released patch immediately through the Microsoft Security Response Center update detailed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32171. As Azure Logic Apps is a managed service, remediation typically involves Microsoft deploying platform-level fixes, though customers may need to take specific actions such as rotating compromised credentials, updating workflow configurations, or re-authorizing connector authentication. Review all Logic Apps workflows for potentially exposed credentials and perform credential rotation for all integrated services as a precautionary measure. Implement Azure role-based access control (RBAC) with least-privilege principles to limit user access to Logic Apps resources. Enable Azure Monitor logging and review historical logs for suspicious credential access patterns. Audit connector configurations and remove unused or overprivileged service connections. For workflows handling sensitive integrations, consider implementing Azure Key Vault for credential management and ensure managed identity authentication is used where supported to eliminate stored credentials entirely.