Azure Logic Apps EUVD-2026-63626

The core prerequisite is user interaction (CVSS UI:R): a victim with legitimate access must trigger or interact with the attacker-supplied request or workflow input for exploitation to succeed, so this is not a fully autonomous remote attack. No prior authentication is required by the attacker (PR:N), the vector is network-reachable (AV:N), and attack complexity is low (AC:L). The concrete technical condition is that attacker-controlled input reaches path-construction logic in Azure Logic Apps that fails to confine the pathname to its restricted directory (CWE-22). The primary limiting factor is the required user interaction; because Azure Logic Apps is a Microsoft-hosted service, exposure also depends on the specific service configuration and endpoints an organization has provisioned. The exact feature or endpoint that parses the traversable path is not detailed in the provided data and should be confirmed via the Microsoft advisory.

The signals are strong but partly incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) points to network-reachable, low-complexity, unauthenticated exploitation with high impact to confidentiality, integrity, and availability and a scope change - a genuinely high-priority profile. The single tempering factor is UI:R: exploitation requires a victim to take some action (e.g. following a crafted link or opening a crafted workflow input), which shifts this toward social-engineering-assisted rather than fully autonomous, wormable exploitation. Counterbalancing signals are missing: no EPSS score, no SSVC decision data, and no KEV listing were provided, and there is no evidence of public POC, so real-world exploitation pressure cannot be quantified from the input. Because Azure Logic Apps is a Microsoft-operated cloud service, remediation is largely vendor-side, which reduces customer patching burden but also limits customer visibility into exposure; any operator relying on Logic Apps should treat a 9.6 privilege-elevation flaw with a changed scope as urgent and confirm mitigation status via the Microsoft advisory, despite the missing EPSS/KEV context.

An attacker crafts a request or workflow input containing path-traversal sequences targeting an Azure Logic Apps endpoint and lures an authorized user into triggering it (satisfying UI:R), for example by following a malicious link. The traversal escapes the intended directory boundary and, given the changed scope, lets the attacker read or manipulate resources in a higher-privilege context, elevating privileges. No public exploit code has been identified at time of analysis.