What is the CVSS score of CVE-2026-40412?

CVE-2026-40412 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Azure Orbital Spatio are affected by CVE-2026-40412?

Microsoft Azure Orbital Spatio contains a critical remote code execution vulnerability (CVE-2026-40412, CVSS 9.8) in file upload validation that allows network-based attackers to execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-40412?

Within 24 hours, identify all production and non-production instances of Microsoft Azure Orbital Spatio in use and assess exposure scope. Within 7 days, apply the vendor-released patch to all affected Azure Orbital Spatio deployments and validate that file upload type validation functions correctly. Within 30 days, conduct a security audit of file upload handling across dependent applications to identify similar validation gaps and implement compensating controls.

Azure Orbital Spatio CVE-2026-40412

EUVD-2026-31511 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-22 microsoft

GHSA-46m7-mpp9-r4v3

Microsoft File Upload Azure Orbital Spatio

9.8

CVSS 3.1 · NVD

Temporal: 8.7

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

8.7 HIGH

cvss

vuln.today AI

9.8 CRITICAL

Network-reachable upload endpoint with no authentication, no interaction, and low complexity yields full code execution, so C/I/A all High and PR:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 11:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 11:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 11:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

May 22, 2026 - 22:46 vuln.today

DescriptionNVD

Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Azure Orbital Spatio allows an unauthorized network attacker to upload a file of a dangerous type and execute arbitrary code against the service. The flaw stems from missing validation of uploaded file types (CWE-434), carries a CVSS 9.8 rating, and per Microsoft a patch is available. No public exploit has been identified at time of analysis, and CISA SSVC currently records exploitation status as none, though the weakness is assessed as automatable with total technical impact.

Technical ContextAI

Azure Orbital Spatio is a Microsoft Azure cloud service in the Azure Orbital family, which provides ground-station-as-a-service and geospatial/satellite data processing capabilities. The affected component (CPE cpe:2.3:a:microsoft:azure_orbital_spatio) exposes a file upload capability that fails to restrict or validate the type of uploaded content. The root cause class is CWE-434, Unrestricted Upload of File with Dangerous Type: when an application accepts a file without verifying its extension, MIME type, or content, an attacker can upload an executable or server-interpretable payload (for example a web shell or script) that the server subsequently processes or executes, converting an upload primitive into arbitrary code execution.

RemediationAI

Because Azure Orbital Spatio is a Microsoft-operated cloud service, the primary remediation is vendor-side: Microsoft reports a patch is available (Patch available per vendor advisory), so consult and follow the Microsoft Security Response Center guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40412 to confirm the fix has been applied to your tenant and whether any customer action is required. No discrete fixed version number is published in the available data, so the exact release identifier cannot be cited. As compensating controls pending confirmation, restrict network access to any file-upload endpoints of the service (for example via Azure network security groups, private endpoints, or firewall rules limiting source addresses), enforce authentication and least-privilege access on the workflows that reach the upload surface, and monitor for anomalous uploads or process execution; note these controls may reduce legitimate integration functionality and do not substitute for the vendor fix.