EUVD-2026-54318
GHSA-vh56-6m73-5483
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable path traversal requiring only low-privilege auth; no UI needed; full C/I/A impact consistent with privilege escalation enabling arbitrary file access.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Path traversal in Microsoft Application Insights Profiler allows an authenticated low-privilege network attacker to escalate privileges, with high confidentiality, integrity, and availability impact. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) indicates exploitation requires no special conditions beyond a valid low-privilege account and network reachability, making the barrier to exploitation low. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and high impact profile warrant prompt remediation.
Technical ContextAI
Application Insights Profiler is a Microsoft Azure-integrated performance monitoring and diagnostics component used in application observability pipelines. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates the profiler fails to canonicalize or adequately validate file path inputs before using them in filesystem operations, allowing an attacker to supply sequences such as '../' to escape an intended directory boundary. Because the profiler operates with elevated system context (as is typical for profiling agents), a successful traversal that writes to or reads from privileged paths results in privilege escalation. The network attack vector (AV:N) confirms the vulnerable functionality is exposed over a network interface rather than requiring local access. No CPE strings were provided, so the exact affected component version range cannot be independently confirmed from this data set.
RemediationAI
Consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49163 for the official patched version. No specific fix version number was included in the provided data, so an exact upgrade target cannot be cited here - treat the MSRC advisory as the authoritative source. As a compensating control where immediate patching is not possible, restrict network access to the Application Insights Profiler endpoint to only trusted internal hosts or management networks, reducing the effective attack surface by limiting which accounts and networks can reach the vulnerable functionality. Additionally, audit and restrict which user accounts hold the low-privilege access sufficient to reach the profiler service, applying the principle of least privilege to limit potential exploiters. Note that network controls do not eliminate the vulnerability; patching remains the definitive remediation.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today