Azure Logic Apps CVE-2026-70200

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required and the attack is network-reachable against Azure Logic Apps. The description specifies path traversal ('improper limitation of a pathname to a restricted directory') as the mechanism, but Microsoft's advisory does not name the specific endpoint, feature, or configuration that must be reachable, so the exact triggering surface is not documented. The principal limiting factor is that Azure Logic Apps is a Microsoft-managed cloud service: remediation is applied centrally by Microsoft rather than by customers, so tenant exposure depends on whether the service instance predates Microsoft's fix rather than on any customer-side setting.

Signals are mixed. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H) describes an unauthenticated, network-reachable, low-complexity flaw with total impact, and CISA's SSVC concurs that technical impact is 'total' and the flaw is 'automatable: yes' - both worst-case indicators. However, the SSVC 'Exploitation: none' rating, absence from CISA KEV, no known public POC, and a modest EPSS of 0.58% (47th percentile) all indicate there is no evidence of real-world exploitation and only middling predicted likelihood. A critical mitigating factor not reflected in the raw score: Azure Logic Apps is a Microsoft-operated cloud (PaaS) service, so the fix is deployed centrally by Microsoft rather than requiring customer patching - meaning the practical window of exposure for tenants is largely closed once Microsoft remediates. There is also a semantic tension to verify: the description frames this as a privilege-elevation ('elevate privileges over a network') while the CVSS vector encodes it as fully unauthenticated (PR:N) with total CIA loss, which reads more like remote takeover than classic EoP - Microsoft's advisory is sparse and does not resolve this. Net: high theoretical severity, but as a centrally-patched cloud service with no exploitation evidence this is a lower operational priority for most defenders than the 9.8 implies.

A remote, unauthenticated attacker sends crafted requests containing directory-traversal sequences to an Azure Logic Apps endpoint, escaping the intended restricted directory to access or manipulate resources outside its scope and thereby gain elevated privileges over the service. Because CVSS marks AV:N/AC:L/PR:N/UI:N and SSVC marks the attack automatable, the request could be scripted at scale. No public exploit code has been identified at time of analysis.