EUVD-2026-82589
GHSA-4xw4-cmxh-ph56
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Network-reachable unauthenticated access-control bypass crossing a tenant/authorization boundary (S:C) with high confidentiality and integrity impact; no availability impact stated, matching the vendor vector.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Improper access control in Microsoft's Azure Logic Apps cloud service allows an unauthenticated, remote attacker to elevate privileges, with the vendor scoring it at the maximum CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Per the CVSS vector the attacker needs no credentials and no user interaction, and the scope change (S:C) indicates the flaw can affect resources beyond the vulnerable component's own security boundary - consistent with a multi-tenant cloud authentication/authorization bypass rather than a memory-safety or injection bug. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions per the CVSS vector - remote unauthenticated exploitation over the network (AV:N/AC:L/PR:N/UI:N) against the Microsoft-hosted Azure Logic Apps service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a maximum-severity flaw by vendor scoring: CVSS 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - network-reachable, low complexity, no privileges, no user interaction, and a scope change yielding high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Microsoft remediated this issue server-side in the Azure Logic Apps service, so there is no customer-installable patch and no exact fixed version to cite; the authoritative advisory is the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83944. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm with Microsoft that the server-side remediation for CVE-2026-83944 has been applied to your Azure Logic Apps instances and review Azure Activity Logs for any unauthorized access or anomalous workflow executions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege elevation in Microsoft's Azure Billing service allows unauthenticated remote attackers to cross a trust bounda
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire
Path traversal (CWE-22) in Azure Logic Apps allows an unauthenticated, network-reachable attacker to escape the intended
Unauthenticated remote privilege escalation in Microsoft's Azure AI Foundry cloud service: a critical function is expose
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate pr
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud
Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate priv
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today