What is the CVSS score of EUVD-2026-48737?

EUVD-2026-48737 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.0%.

Which versions of Azure Portal are affected by EUVD-2026-48737?

Microsoft Azure Portal contains an information disclosure vulnerability (CVE-2026-62835) that allows unauthenticated attackers to access sensitive cloud infrastructure data through an authorization…. A patch is available.

How to fix or mitigate EUVD-2026-48737?

Within 24 hours, review Azure Portal activity logs for unauthorized access patterns and contact Microsoft to confirm patch availability for your subscription; enable additional Portal access monitoring to detect ongoing exploitation attempts. Within 7 days, validate the available security patch in a non-production Azure environment and schedule deployment through your standard change management process. Within 30 days, deploy the patch to all production Azure Portal instances and verify that authorization controls now properly restrict access to authorized users only.

Azure Portal EUVD-2026-48737

| CVE-2026-62835 HIGH

Improper Authorization (CWE-285)

2026-07-24 microsoft

Authentication Bypass Microsoft Azure Portal

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

CRITICAL

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable Portal endpoint exploitable without authentication or interaction at low complexity; impact is confidentiality-only disclosure, so I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 15:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 15:07 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 15:07 NVD

CRITICAL HIGH

CVSS changed

Jul 29, 2026 - 15:07 NVD

9.3 (CRITICAL) 7.5 (HIGH)

Analysis Generated

Jul 26, 2026 - 11:41 vuln.today

CVE Published

Jul 24, 2026 - 19:21 cve.org

CRITICAL 9.3

DescriptionNVD

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Azure Portal allows a remote, unauthenticated attacker to access sensitive data they are not authorized to view by exploiting an improper authorization check (CWE-285) reachable over the network. The flaw affects the cloud-hosted Azure management console and, per its CVSS vector, requires no privileges or user interaction while yielding high confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the issue is assessed as automatable; the EPSS probability is modest at 1.03%.

Technical ContextAI

Azure Portal is Microsoft's web-based, multi-tenant management console (cpe:2.3:a:microsoft:azure_portal) used to provision and administer Azure cloud resources. The root cause is CWE-285 Improper Authorization: an access-control decision fails to correctly verify that the requesting principal is entitled to the returned data, so authorization is enforced inconsistently or omitted on a network-reachable code path. Because the Portal is a shared cloud service backed by REST/ARM APIs, a missing or flawed authorization check can expose one tenant's or user's metadata or resource information to another party without any credential escalation. This is a service-side (vendor-hosted) defect rather than a bug in installed software, so remediation is delivered by Microsoft rather than by customer patching.

RemediationAI

Because Azure Portal is a Microsoft-operated cloud service, the fix is a server-side change deployed by the vendor rather than a customer-applied update: Patch available per vendor advisory (MSRC, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62835) - no discrete customer patch version is published, and no customer action is strictly required once Microsoft has deployed the remediation. Verify remediation status via the MSRC update guide entry for CVE-2026-62835. As defense-in-depth for the confidentiality exposure, review Azure activity and sign-in logs and Portal access records for the pre-fix window for any anomalous data-access patterns, enforce least-privilege RBAC and Conditional Access so that even successful unauthorized reads are minimized, and, where feasible, restrict Portal access to trusted networks/managed devices via Conditional Access to shrink the attacker population. These controls have the trade-off of added administrative overhead and potential friction for legitimate remote administrators but do not degrade Portal functionality.