What is the CVSS score of CVE-2026-40411?

CVE-2026-40411 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Virtual Network Gateway are affected by CVE-2026-40411?

A critical remote code execution vulnerability in Microsoft Azure Virtual Network Gateway could allow authenticated users to gain complete administrative control over gateway operations.. A patch is available.

How to fix or mitigate CVE-2026-40411?

Within 24 hours: Inventory all Microsoft Azure Virtual Network Gateway deployments using Azure Resource Graph; assess which users and service principals have network access to these gateways. Within 7 days: Apply the vendor-released patch from Microsoft to all gateway instances, coordinating with infrastructure teams to schedule deployments during maintenance windows. Within 30 days: Verify patch application across all instances using Azure Update Management; implement network segmentation to restrict gateway access to authorized administrative users only.

Azure Virtual Network Gateway CVE-2026-40411

EUVD-2026-31510 HIGH

Improper Input Validation (CWE-20)

2026-05-22 microsoft

GHSA-g63w-3vwq-rqw8

Information Disclosure Microsoft Azure Virtual Network Gateway

8.8

CVSS 3.1 · NVD

Temporal: 8.6

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

8.6 HIGH

cvss

vuln.today AI

8.8 HIGH

Network-reachable service exploitable with low complexity and no user interaction, but requires low-privilege authentication (PR:L); improper input validation yields code execution with total C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 11:47 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 23, 2026 - 11:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Jul 23, 2026 - 11:22 NVD

CRITICAL HIGH

CVSS changed

Jul 23, 2026 - 11:22 NVD

9.9 (CRITICAL) 8.8 (HIGH)

Analysis Generated

May 22, 2026 - 22:45 vuln.today

DescriptionNVD

Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Azure Virtual Network Gateway allows an authenticated attacker to run arbitrary code over the network by supplying malformed input that the service fails to validate (CWE-20). Any low-privileged principal with network access to the gateway can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.09% 30-day exploitation probability, but the CVSS 8.8 and 'total' technical impact keep it a meaningful priority.

Technical ContextAI

Azure Virtual Network Gateway is a Microsoft-managed cloud service (CPE cpe:2.3:a:microsoft:azure_virtual_network_gateway) that provides cross-premises connectivity - site-to-site and point-to-site VPN and ExpressRoute - bridging Azure virtual networks with on-premises networks or remote clients. The root cause is CWE-20 (Improper Input Validation): the gateway processes attacker-supplied network input without adequately checking its structure or bounds, allowing that input to influence execution flow and reach a code-execution primitive. Because this is a Platform-as-a-Service component, remediation is delivered by Microsoft on the service side rather than by customer-installed patches.

RemediationAI

Patch available per vendor advisory: Microsoft reports a fix is available and, as with cloud PaaS, the mitigation is applied by Microsoft to the service - customers should confirm their gateways are running the remediated service build via Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40411. No exact fixed version number is provided in the available data, so do not assume a specific build string. As compensating controls while confirming remediation, tighten the set of principals that can reach the gateway: restrict management-plane access with Azure RBAC least-privilege (removing unneeded low-privilege roles that satisfy the PR:L precondition), constrain point-to-site and management access with conditional access and network scoping so only trusted identities and source ranges can connect, and monitor gateway diagnostic logs for anomalous or malformed connection attempts. The trade-off of aggressive access restriction is potential disruption to legitimate VPN/ExpressRoute clients and automation, so validate connectivity after changes.