EUVD-2026-54324
GHSA-fm3h-q54v-rjrj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable deserialization needing only low-privilege authorized access (PR:L); code execution escapes the caller's authority (S:C) with full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Azure Service Bus lets an already-authorized (PR:L) attacker send maliciously crafted serialized data that the service deserializes without validation (CWE-502), executing attacker-controlled code across the network. The scope-changed CVSS 9.9 rating reflects that code execution can break out of the caller's authorization boundary into the underlying managed-service host, threatening confidentiality, integrity, and availability of the messaging infrastructure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess valid low-privilege access to the Azure Service Bus namespace or entity (CVSS PR:L, 'authorized attacker'), and to be able to deliver a crafted serialized payload over the network to the deserialization path (AV:N, AC:L, UI:N - no victim interaction and low complexity once access is held). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H, base 9.9) signals network reachability, low complexity, no user interaction, only low privileges required, and a scope change with full triad impact - a very strong technical risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds a low-privilege credential or SAS token for a Service Bus entity submits a specially crafted serialized payload that the service deserializes, instantiating attacker-chosen objects that trigger code execution on the processing host. Because scope is changed, the resulting execution can reach beyond the attacker's original authorization boundary into the underlying managed infrastructure. … |
| Remediation | Because Azure Service Bus is a Microsoft-operated cloud service, the primary remediation is server-side and applied by Microsoft; review https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50515 to confirm whether action is required and whether any client SDK update is recommended (Patch available per vendor advisory; no exact fix version was provided in the input). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Initiate critical incident response-contact Microsoft Support to confirm exposure status for your Service Bus namespaces and obtain patch availability timeline, then immediately audit production systems and sensitive workloads running on Service Bus. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today