What is the CVSS score of CVE-2026-42823?

CVE-2026-42823 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Logic Apps are affected by CVE-2026-42823?

A critical privilege escalation vulnerability in Microsoft Azure Logic Apps (CVE-2026-42823, CVSS 9.9) enables attackers to elevate permissions and gain unrestricted access to Logic Apps instances…. A patch is available.

How to fix or mitigate CVE-2026-42823?

Within 24 hours: Identify and catalog all Microsoft Azure Logic Apps instances across production and development environments, documenting connected data sources and systems for each application. Within 7 days: Apply the vendor-released patch to all affected Azure Logic Apps instances, conducting functional testing on non-production systems first to validate compatibility. Within 30 days: Confirm patch deployment across all Logic Apps, audit access logs for unauthorized privilege escalation attempts since the vulnerability disclosure date, and review access controls to ensure least-privilege restrictions remain in place.

Azure Logic Apps CVE-2026-42823

EUVD-2026-29708 CRITICAL

Improper Access Control (CWE-284)

2026-05-12 microsoft

GHSA-73g5-7fvx-cpr5

Microsoft Authentication Bypass Azure Logic Apps

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.9 CRITICAL

Network-reachable service, low complexity, requires an existing low-privilege foothold (PR:L); access-control bypass crosses an authorization boundary (S:C) enabling total C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:04 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

CRITICAL 9.9

DescriptionCVE.org

Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate their permissions over the network via improper access control (CWE-284). The CVSS 9.9 score is driven by a scope change (S:C), meaning a successful attack breaches the security boundary of the vulnerable component and impacts other resources with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), consistent with CISA SSVC rating exploitation as 'none'.

Technical ContextAI

Azure Logic Apps is Microsoft's cloud-based integration and workflow-automation platform (part of Azure App Service / Azure Integration Services) used to orchestrate business processes, connect SaaS/enterprise systems, and run serverless workflows. The affected CPE is cpe:2.3:a:microsoft:azure_logic_apps, spanning the managed multi-tenant service. The root cause is CWE-284 (Improper Access Control): the platform fails to correctly enforce authorization boundaries, allowing an actor holding some legitimate but low-privilege access to perform actions or reach resources reserved for higher-privileged principals. Because Logic Apps handles connectors, credentials, and workflow execution across tenant resources, an access-control gap here can cross trust boundaries - reflected in the CVSS scope change (S:C).

RemediationAI

Patch available per vendor advisory - the fix is delivered by Microsoft through the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42823. Because Azure Logic Apps is a Microsoft-managed cloud service, remediation is primarily applied server-side by Microsoft and typically requires no customer action; verify your tenant status via the MSRC portal and confirm no residual configuration steps are flagged. As defense-in-depth compensating controls, apply least-privilege to Logic Apps RBAC roles and managed identities so that any low-privilege foothold has minimal blast radius, audit and rotate connector credentials and API connections, restrict management-plane access to the Logic Apps resource using Azure RBAC and Conditional Access, and review Azure Activity Logs and Logic Apps run history for anomalous privilege use. The trade-off of tightening RBAC is potential disruption to legitimate automation workflows, so validate role assignments against operational dependencies before restricting. Corroborating advisories: https://vuldb.com/vuln/363226 and https://nvd.nist.gov/vuln/detail/CVE-2026-42823.