Azure Billing CVE-2026-62874

The description does not name a specific feature, protocol, or configuration setting - it states only that Azure Billing insufficiently verifies data authenticity (CWE-345), allowing an unauthorized attacker to elevate privileges over a network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special client-side configuration are required, and exploitation targets the service as operated. The principal LIMITING factor is the delivery model: Azure Billing is a Microsoft-hosted cloud service, so the vulnerable surface exists only within Microsoft's infrastructure and remediation is applied server-side by the vendor rather than by customers - meaning customer-side exposure depends entirely on Microsoft's patch rollout rather than on local deployment choices. SSVC records Exploitation: none, so no active-exploitation precondition is met at time of analysis.

Signals conflict and must be weighed carefully. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H) describes a maximally severe, remotely reachable, unauthenticated flaw, and SSVC confirms Technical Impact: total and Automatable: yes - both pointing to high potential impact. However, SSVC records Exploitation: none (no observed active exploitation), the CVE is NOT in CISA KEV, and the EPSS score is low at 0.32% (25th percentile), indicating low modeled probability of near-term widespread exploitation. A public artifact labeled as exploit code exists (a GitHub gist), so proof-of-concept availability and active exploitation must not be conflated: publicly available exploit code exists, but there is no confirmed active exploitation. A critical mitigating consideration the raw score obscures: Azure Billing is a Microsoft-operated cloud service, not customer-deployed software, so remediation is performed server-side by Microsoft rather than requiring customer patching - this materially changes the real-world exposure window compared to an equivalent on-premises CVE. Net: genuinely high theoretical severity with total impact and automatability, but tempered by no KEV listing, low EPSS, SSVC exploitation=none, and vendor-side (cloud) remediation. Treat as high-priority for situational awareness, but the headline 9.8 overstates sustained customer-side risk given the cloud-service delivery model.

A remote, unauthenticated attacker crafts data that Azure Billing fails to properly authenticate (CWE-345, insufficient verification of data authenticity), causing the service to trust forged or tampered input and grant elevated privileges. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N and SSVC marks the flaw Automatable: yes, the attack can be launched over the network without credentials or user interaction and scripted at scale. Publicly available exploit code (a GitHub gist) reportedly demonstrates the technique, lowering the barrier to replication.