What is the CVSS score of CVE-2026-50338?

CVE-2026-50338 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Azure Spring Apps are affected by CVE-2026-50338?

Microsoft Azure Spring Apps contains a privilege escalation vulnerability (CVE-2026-50338, CVSS 8.2) that allows authenticated users to bypass access controls and gain higher privileges, creating…. A patch is available.

How to fix or mitigate CVE-2026-50338?

Within 24 hours, identify and document all Azure Spring Apps instances in production and non-production environments, then review access logs for the past 30 days to detect any unauthorized privilege escalation attempts. Within 7 days, apply the Microsoft-released patch to all Azure Spring Apps deployments following the vendor's documented deployment procedure; coordinate with application teams to schedule deployments during maintenance windows to minimize disruption. Within 30 days, verify patch deployment across all instances, validate that privilege boundaries are correctly enforced through access control testing, and document remediation completion for audit and compliance records.

Azure Spring Apps CVE-2026-50338

EUVD-2026-44028 HIGH

Improper Authentication (CWE-287)

2026-07-14 microsoft

GHSA-84r5-fg22-5vjv

Authentication Bypass Java Microsoft Azure Spring Apps

8.2

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.2 HIGH

Requires existing authenticated low-privilege access (PR:L) and non-trivial conditions (AC:H); improper auth crosses a security boundary (S:C) yielding high C/I but no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:21 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 8.2

DescriptionCVE.org

Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.

Articles & Coverage 1

News 5 New Java Vulnerabilities - 1 Critical, 4 High, 1 With POC Jul 15, 2026

AnalysisAI

Privilege elevation in Microsoft Azure Spring Apps allows an already-authenticated, low-privileged network attacker to gain higher privileges by abusing an improper authentication weakness (CWE-287) in the managed platform. Because the CVSS scope is marked as changed (S:C), a successful attack can reach resources beyond the attacker's originally authorized boundary, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Microsoft has published an advisory and a patch is available server-side.

Technical ContextAI

Azure Spring Apps is Microsoft's managed platform (jointly built with VMware Tanzu) for running Spring Boot / Java microservices on Azure, handling service orchestration, config, and identity for hosted applications. The affected component per CPE is cpe:2.3:a:microsoft:azure_spring_apps and the tags identify it as a Java, Microsoft-Azure authentication-bypass issue. The root cause is CWE-287 (Improper Authentication): the platform fails to correctly verify identity or authorization state before granting access, so an authenticated principal can assert privileges it should not hold. The changed-scope flag indicates the vulnerable authentication component and the resources ultimately compromised are managed under different security authorities - typical of a multi-tenant control-plane where breaking auth in one layer exposes another.

RemediationAI

Patch available per vendor advisory - because Azure Spring Apps is a Microsoft-managed service, the fix is applied server-side by Microsoft and customers generally require no manual package upgrade; confirm remediation and any required tenant-side action directly at the MSRC guidance (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50338). As defense-in-depth for the exploitation window, enforce least-privilege on Azure RBAC and Spring Apps roles so that a low-privileged foothold cannot be leveraged (trade-off: tighter roles may require workflow adjustments for operators), review and rotate credentials/managed-identity assignments for hosted apps, and monitor Azure activity and sign-in logs for anomalous privilege-escalation or cross-tenant access patterns. No exact fix version is provided in the input; do not assume a version string - rely on the MSRC advisory for authoritative status.