Azure Data Factory EUVD-2026-63688

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and low-complexity with no privileges and no user interaction claimed. The specific technical prerequisite implied by the description and tags is the ability to present a crafted cryptographic signature/JSON Web Token to an Azure Data Factory endpoint that improperly verifies it (CWE-347) - that flawed signature validation IS the enabling condition. Limiting factors to weigh: the attacker must be able to reach the relevant Data Factory service/API endpoint over the network (mitigated by private endpoints or network restrictions), and there is inherent tension between the 'unauthorized attacker' description and a JWT-bypass mechanism that typically targets an authentication layer, so realistic exploitation may require reaching an endpoint that normally expects a token. SSVC currently rates Exploitation 'none' and Automatable 'no', and no public exploit is identified at time of analysis.

The signals are mixed and warrant careful triage. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) and CISA SSVC 'total' technical impact describe a high-severity, network-reachable, unauthenticated, low-complexity flaw - the worst-case profile. However, corroborating exploitation signals are weak: EPSS is only 0.28% (20th percentile), SSVC lists Exploitation as 'none' and Automatable as 'no', and the vulnerability is not in CISA KEV, with no public exploit identified at time of analysis. This is the pattern of a genuinely dangerous-if-exploited bug that is not (yet) seeing opportunistic mass exploitation, so the practical urgency is driven by the fact that Azure Data Factory is a managed Microsoft cloud service - Microsoft typically remediates such flaws server-side, which materially lowers customer-side exposure once the fix is deployed. Note a tension worth verifying: the description states 'unauthorized attacker' and the vector claims PR:N, yet an authentication-bypass/JWT flaw usually requires the attacker to reach an authenticated endpoint and present a forged token, so confirm with Microsoft's advisory whether any pre-existing access or network position is needed. Treat as a high-priority patch-verification item even though widespread automated exploitation currently appears unlikely.

A remote attacker crafts a forged or tampered JSON Web Token and submits it to an Azure Data Factory endpoint that fails to properly verify the token's cryptographic signature, causing the service to accept it as a valid, higher-privileged identity. Leveraging the accepted token, the attacker performs actions as an elevated principal - for example manipulating pipelines or accessing linked data stores. No public proof-of-concept has been identified, and CVSS indicates low attack complexity with no privileges or user interaction required.