What is the CVSS score of CVE-2026-35425?

CVE-2026-35425 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Azure API Management are affected by CVE-2026-35425?

Microsoft Azure API Management contains a remote code execution vulnerability that permits an authorized attacker with elevated privileges to escalate to full system compromise, threatening the…. A patch is available.

How to fix or mitigate CVE-2026-35425?

Within 24 hours, inventory all Azure APIM instances and document administrative access privileges and network connectivity. Apply the vendor-released patch immediately to all APIM instances; if deployment cannot complete within this window, restrict administrative access to a minimal set of verified personnel using network segmentation and MFA enforcement. Within 7 days, complete patching across your entire APIM estate, conduct a privilege audit to remove unnecessary administrative roles, and review API authorization policies for least-privilege enforcement. Search logs for any anomalous administrative activity or API modifications during the window before patching. Within 30 days, perform a comprehensive security assessment of your API management layer, update incident response procedures to address API platform compromise scenarios, and implement continuous compliance monitoring to ensure all APIM instances remain current with security updates.

Azure API Management CVE-2026-35425

EUVD-2026-48455 HIGH

Improper Access Control (CWE-284)

2026-07-24 microsoft

GHSA-c92r-v9xf-6rqc

Authentication Bypass Microsoft Azure Api Management Apim

7.2

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-delivered attack requiring high privileges (PR:H per description); no user interaction; full C/I/A impact confined to the APIM instance with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 14:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 14:22 NVD

8.0 (HIGH) 7.2 (HIGH)

Analysis Generated

Jul 24, 2026 - 00:48 vuln.today

CVE Published

Jul 24, 2026 - 00:01 cve.org

HIGH 8.0

DescriptionNVD

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Azure API Management (APIM) allows an authorized network attacker to achieve full system compromise via improper access control. The vulnerability (CWE-284) is tagged 'Authentication Bypass,' suggesting that despite requiring high privileges for initial entry, the flaw may allow an attacker to circumvent authorization boundaries within APIM and escalate to code execution. No public exploit has been identified at time of analysis, and SSVC confirms no current exploitation; however, the total technical impact (C:H/I:H/A:H) makes patching a priority for any organization running Azure API Management workloads.

Technical ContextAI

Azure API Management (APIM) is Microsoft's managed cloud service for publishing, securing, transforming, and monitoring APIs at scale. It acts as a gateway and policy enforcement layer for backend services. The affected CPE (cpe:2.3:a:microsoft:azure_api_management_(apim):*:*:*:*:*:*:*:*) encompasses all tracked versions with no bounded upper limit, indicating broad version exposure. The root cause is CWE-284 (Improper Access Control), a class of flaws where the software fails to correctly restrict access to a resource or capability. In APIM's context, this likely manifests as an insufficiently enforced authorization boundary within the management plane or gateway policy execution layer, allowing a high-privileged caller to reach a code execution path that should be further restricted. The 'Authentication Bypass' tag introduces a nuance: while the CVSS vector assigns PR:H (high privileges required), the bypass tag suggests the flaw may allow privilege escalation or lateral movement once initial authenticated access exists.

RemediationAI

Apply the vendor-released patch from Microsoft via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35425. An exact patched version number has not been surfaced in NVD or EUVD data; organizations should consult the MSRC page directly to confirm the specific update required and whether it is delivered as an automatic Azure platform update or requires manual action. As a compensating control pending patch confirmation, restrict the set of identities holding high-privilege roles (Contributor, Owner, APIM Service Contributor) within Azure APIM to the minimum necessary principals, and enable Azure AD Privileged Identity Management (PIM) just-in-time access to reduce standing high-privilege access - this directly limits the attacker pool given the PR:H exploitation requirement. Additionally, enable diagnostic logging and Azure Monitor alerts on anomalous APIM management-plane operations. Note: these controls reduce exposure but do not eliminate the underlying flaw.