EUVD-2026-63625
GHSA-5vp6-c73p-75c8
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-hosted cloud API (AV:N); authenticated low-privilege account required per description (PR:L); AC:H reflects non-trivial integer overflow trigger; S:C confirmed by cross-boundary RCE impact with full CIA triad.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Azure Data Manager for Energy exploits a CWE-190 integer overflow, allowing a network-reachable low-privilege authenticated attacker to execute arbitrary code with a scope change that can impact adjacent system components. The CVSS 8.5 vector (AV:N/AC:H/PR:L/S:C/C:H/I:H/A:H) delivers a full CIA impact triad but is gated by high attack complexity, limiting reliable exploitation to sophisticated actors who can meet specific technical preconditions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid low-privilege authenticated account on the target Azure Data Manager for Energy instance - this is confirmed by the PR:L CVSS metric and the description's use of 'authorized attacker', making unauthenticated exploitation impossible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 High score is justified by the network attack vector, scope change, and full C/I/A impact, but the AC:H metric is a material risk moderator - reliable exploitation requires meeting specific preconditions (particular API state, call sequence, or input structure) not achievable through simple spray-and-pray techniques. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available per vendor advisory; the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69419 is the authoritative reference for remediation steps. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Microsoft Azure Data Manager for Energy deployments and enable audit logging to detect exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today