What is the CVSS score of EUVD-2026-31510?

EUVD-2026-31510 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Virtual Network Gateway are affected by EUVD-2026-31510?

Microsoft Azure Virtual Network Gateway is exposed to a critical remote code execution vulnerability (CVE-2026-40411) that enables authenticated attackers with low privileges to execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-31510?

Within 24 hours: Inventory all Azure Virtual Network Gateway instances and audit access permissions for low-privilege accounts; restrict unnecessary access pending patch application. Within 7 days: Apply the available vendor patch to all affected Azure VNG deployments. Within 30 days: Verify patch deployment across all environments and conduct network segmentation testing to confirm operational integrity.

Azure Virtual Network Gateway EUVD-2026-31510

| CVE-2026-40411 CRITICAL

Improper Input Validation (CWE-20)

2026-05-22 microsoft

GHSA-g63w-3vwq-rqw8

Microsoft Information Disclosure

9.9

CVSS 3.1 · NVD

Temporal: 8.6

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CIRCL (temporal)

8.6 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 22:45 vuln.today

DescriptionCVE.org

Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Azure Virtual Network Gateway allows an authenticated attacker with low privileges to execute arbitrary code across a network boundary due to improper input validation. The CVSS 9.9 score reflects scope-changed impact (S:C) where exploitation can compromise resources beyond the vulnerable component itself, affecting confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the high score and managed-service nature warrant priority attention.

Technical ContextAI

Azure Virtual Network Gateway is a managed Microsoft Azure service that provides cross-premises connectivity (VPN gateways for site-to-site/point-to-site IPsec tunnels and ExpressRoute gateways for private peering) between Azure virtual networks and on-premises networks or other VNets. The root cause is CWE-20 (Improper Input Validation), meaning the gateway accepts and processes untrusted data without sufficient validation, allowing crafted inputs to alter execution flow. The affected CPE (cpe:2.3:a:microsoft:azure_virtual_network_gateway) covers the Azure-hosted service component, suggesting the flaw is in the control or data plane code path that parses network protocol or management input.

RemediationAI

Patch available per vendor advisory - Microsoft has released a fix on the Azure platform; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40411 to confirm whether the remediation is automatically applied to your gateway SKU or requires customer action such as a gateway reset, SKU upgrade, or redeployment. As compensating controls until remediation is verified, restrict who holds low-privileged Azure RBAC roles on Virtual Network Gateway resources (since PR:L is required), tighten Network Security Group rules to limit which subnets can reach gateway endpoints, enable Azure activity log and diagnostic log collection for the gateway to detect anomalous configuration calls, and consider temporarily disabling unused VPN client protocols (IKEv2, OpenVPN, SSTP) on Point-to-Site configurations - accepting the trade-off that legitimate remote users on those protocols will lose connectivity.