Azure Logic Apps EUVD-2026-29708

Exploitation requires the attacker to already possess low-level privileges (CVSS PR:L) within reach of the Azure Logic Apps service - an authenticated foothold such as a limited tenant role, a compromised service principal/managed identity, or contributor-level access to a Logic App resource. No user interaction is required (UI:N) and the vector is network-based (AV:N) with low attack complexity (AC:L). The key LIMITING factor is that this is not an unauthenticated, internet-wide vulnerability: an attacker cannot exploit it without first obtaining valid low-privilege access, making it a privilege-escalation primitive contingent on prior compromise rather than an initial-access flaw. The description does not name a specific feature toggle or non-default configuration as a precondition, so exposure should be assumed for the standard service until Microsoft's server-side fix is applied.

The signals here are genuinely conflicting and warrant nuance. CVSS is 9.9 (Critical) with AV:N/AC:L/PR:L/UI:N and a scope change plus total C/I/A impact, indicating a network-reachable, low-complexity escalation requiring only minimal existing privilege. However, EPSS is very low at 0.06% (18th percentile), and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', while agreeing Technical Impact is 'total'. This is a case of high theoretical severity but low observed/near-term exploitation risk: the impact if exploited is catastrophic (full compromise across a scope boundary), but there is no evidence of exploitation, no public PoC, and it is not readily automatable. Because Azure Logic Apps is a Microsoft-managed cloud service, the fix is largely server-side and the practical exposure window for customers is limited. Prioritize based on impact and the fact that PR:L means a foothold is a prerequisite - this is an escalation primitive, not an initial-access, internet-wide worm risk.

An attacker who already holds a low-privilege account or role within an Azure tenant (for example, contributor access to a single Logic App or a compromised service principal) sends crafted requests to the Logic Apps service to abuse the improper access-control check and escalate to higher-privileged operations. Given the scope change, this lets them reach resources beyond their original authorization boundary, achieving full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and low complexity (AC:L) means no special timing or race conditions are required once the prerequisite foothold exists.