EUVD-2026-31510
GHSA-g63w-3vwq-rqw8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable service exploitable with low complexity and no user interaction, but requires low-privilege authentication (PR:L); improper input validation yields code execution with total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Azure Virtual Network Gateway allows an authenticated attacker to run arbitrary code over the network by supplying malformed input that the service fails to validate (CWE-20). Any low-privileged principal with network access to the gateway can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.09% 30-day exploitation probability, but the CVSS 8.8 and 'total' technical impact keep it a meaningful priority.
Technical ContextAI
Azure Virtual Network Gateway is a Microsoft-managed cloud service (CPE cpe:2.3:a:microsoft:azure_virtual_network_gateway) that provides cross-premises connectivity - site-to-site and point-to-site VPN and ExpressRoute - bridging Azure virtual networks with on-premises networks or remote clients. The root cause is CWE-20 (Improper Input Validation): the gateway processes attacker-supplied network input without adequately checking its structure or bounds, allowing that input to influence execution flow and reach a code-execution primitive. Because this is a Platform-as-a-Service component, remediation is delivered by Microsoft on the service side rather than by customer-installed patches.
RemediationAI
Patch available per vendor advisory: Microsoft reports a fix is available and, as with cloud PaaS, the mitigation is applied by Microsoft to the service - customers should confirm their gateways are running the remediated service build via Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40411. No exact fixed version number is provided in the available data, so do not assume a specific build string. As compensating controls while confirming remediation, tighten the set of principals that can reach the gateway: restrict management-plane access with Azure RBAC least-privilege (removing unneeded low-privilege roles that satisfy the PR:L precondition), constrain point-to-site and management access with conditional access and network scoping so only trusted identities and source ranges can connect, and monitor gateway diagnostic logs for anomalous or malformed connection attempts. The trade-off of aggressive access restriction is potential disruption to legitimate VPN/ExpressRoute clients and automation, so validate connectivity after changes.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today