EUVD-2026-63626
GHSA-66h9-689p-45mg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable, low-complexity, unauthenticated path traversal needing victim interaction (UI:R); traversal escaping into a higher-privilege context justifies S:C with high C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft Azure Logic Apps allows an unauthenticated, remote attacker to escalate privileges by abusing a path-traversal flaw (CWE-22) that fails to restrict a supplied pathname to its intended directory, provided a victim is lured into interacting (UI:R). Rated CVSS 9.6 with a changed scope, indicating impact beyond the initially vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The core prerequisite is user interaction (CVSS UI:R): a victim with legitimate access must trigger or interact with the attacker-supplied request or workflow input for exploitation to succeed, so this is not a fully autonomous remote attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strong but partly incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: consult and apply guidance from Microsoft's MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69400. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, obtain the vendor-released patch from Microsoft and validate in non-production environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Azure Logic Apps
View allPrivilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they
Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevat
Microsoft Power Platform Connector Spoofing Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotel
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today