Spring Cloud Azure CVE-2026-69854

Requires network access to a Java application that embeds Spring Cloud Azure at version 1.0.0 up to (but not including) 7.4.0. No authentication and no user interaction are needed (PR:N/UI:N), but the CVSS AC:H indicates exploitation depends on specific, non-trivial conditions - most plausibly a particular Spring Cloud Azure authentication/identity configuration or timing that the attacker must satisfy or win. Limiting factors: the flaw is confined to deployments actually using the vulnerable Spring Cloud Azure authentication path, the affected version window is bounded (fixed in 7.4.0), and the elevated CVSS complexity means it is not a guaranteed single-request compromise. The exact feature or configuration that must be present is not disclosed in the available advisory text and should be verified against the MSRC guidance.

This is a genuinely serious library vulnerability that warrants prompt patching, but the signals are mixed rather than screaming emergency. The CVSS 3.1 vector (8.1, AV:N/PR:N/UI:N) shows a network-reachable flaw needing no authentication and no user interaction, with full C:H/I:H/A:H impact consistent with an authentication/privilege-elevation bypass (CWE-287). The one factor holding it back from critical is AC:H - the vendor judges successful exploitation to require specific conditions or effort rather than a trivial single request. EPSS is low (0.64%, 49th percentile), which is consistent with AC:H and with the absence of any published exploit; it suggests exploitation is not (yet) trivially automatable or widespread. The CVE is NOT on CISA KEV and there is no public POC, so this is no public exploit identified at time of analysis - do not treat it as actively exploited. Net: a real, high-severity priority for anyone running Spring Cloud Azure below 7.4.0 because it is unauthenticated privilege escalation and a patch exists, but the AC:H and low EPSS argue this is a patch-in-the-normal-urgent-cycle item rather than a drop-everything zero-day. No conflicting signals were found between the vector and description; both point to a network, unauthenticated auth flaw.

A remote, unauthenticated attacker sends specially crafted requests to a Java application built on the vulnerable Spring Cloud Azure library, abusing the improper authentication logic to bypass identity checks and act as a higher-privileged principal. Because the CVSS complexity is High (AC:H), the attacker likely needs specific conditions met (e.g., particular authentication configuration or timing), but no credentials or victim interaction are required. No public exploit code exists at time of analysis.