EUVD-2026-82592
GHSA-j33w-4pg5-pvc7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Network-reachable, unauthenticated, no interaction path traversal crossing a trust boundary (S:C) with high confidentiality and integrity impact and no availability impact, matching the described privilege elevation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Path traversal (CWE-22) in Azure Logic Apps allows an unauthenticated, network-reachable attacker to escape the intended directory restriction and elevate privileges, yielding high confidentiality and integrity impact with no availability impact under a scope-changed CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Because Azure Logic Apps is a Microsoft-operated PaaS service, the affected surface is the hosted platform itself rather than a customer-installed binary, so exposure is bounded to the window before Microsoft's server-side fix plus any self-hosted or hybrid Logic Apps runtime that shares the vulnerable code path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation over the network against Azure Logic Apps (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a maximum-severity finding that warrants priority attention on signal strength, but real-world urgency for customers is nuanced because Azure Logic Apps is a Microsoft-operated cloud (PaaS) service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary remediation is vendor-side: Microsoft operates Azure Logic Apps, so the fix is applied to the platform and customers have no patch or version to install - track the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70200 for confirmation of the fix and any scope statements. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm with Microsoft via Azure Service Health and the Microsoft Security Response Center whether our tenant's Logic Apps, Standard single-tenant, and any self-hosted/hybrid Logic Apps runtime are affected, inventory every Logic Apps workflow and its trigger endpoints, and remove or lock down anonymous HTTP request triggers and publicly reachable callback URLs by enforcing IP restrictions, private endpoints, or VNet integration; restrict inbound access through Azure WAF or Front Door where those endpoints are internet-facing, and enable diagnostic logging and Defender for Cloud alerts on the affected resources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege elevation in Microsoft's Azure Billing service allows unauthenticated remote attackers to cross a trust bounda
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire
Unauthenticated remote privilege escalation in Microsoft's Azure AI Foundry cloud service: a critical function is expose
Improper access control in Microsoft's Azure Logic Apps cloud service allows an unauthenticated, remote attacker to elev
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate pr
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud
Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate priv
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today