EUVD-2026-63625
GHSA-5vp6-c73p-75c8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable cloud API requiring only low-privilege credentials; integer overflow enables full code execution, justifying C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated identity with at least low-privilege access to the target Azure Data Manager for Energy tenant - consistent with PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (High) is broadly supported by the signals: AV:N/AC:L/PR:L confirms this is a low-friction, network-reachable flaw exploitable by any authenticated tenant user without special configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Because Azure Data Manager for Energy is a Microsoft-managed PaaS offering, the patch is deployed by Microsoft to the service backend - tenant customers do not install updates themselves. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit access logs to identify all users and service accounts with credentials to Azure Data Manager for Energy and catalog all service instances across your Azure subscriptions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today