EUVD-2026-82599
GHSA-46p6-9vjm-f58q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable XSS by an unauthenticated attacker (PR:N) but requiring a victim to load content (UI:R); script escapes into the privileged portal origin (S:C) yielding token/data theft (C:H, I:L, A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in the hosted Microsoft Azure Portal (CVE-2026-83946) allows an unauthenticated attacker to have malicious script rendered inside the privileged portal origin, escaping into a trusted administrative context once an authenticated portal user (typically an administrator) loads or clicks attacker-controlled content. The vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N rates this 8.2 (High), driven chiefly by the scope change (S:C) and high confidentiality impact (C:H) - meaning injected script can read data across the portal origin - with the required victim interaction (UI:R) as the main limiting factor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Azure Portal user (typically an administrator) to view attacker-controlled content rendered by the portal - the UI:R in the vector reflects this mandatory victim interaction, such as clicking a crafted link or loading a resource whose attacker-supplied field is rendered unsanitized. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) rates this High, driven primarily by C:H and the scope change (S:C), meaning injected script escapes into the privileged Azure Portal origin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No customer-side patch or upgrade applies: Microsoft remediated this cross-site scripting flaw in the Azure Portal server-side, and the vulnerability is fixed in the hosted service, so affected organizations should verify via the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83946) that they are on the remediated service and take no further software action. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify that all Microsoft Azure Portal administrative accounts are protected with phishing-resistant multi-factor authentication (MFA) and review recent portal sign-in and activity logs for any suspicious behavior. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full comprom
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate pr
Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restr
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
Unauthenticated remote attackers can reach a critical function inside Microsoft Azure AI Foundry that performs a privile
Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud
Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate priv
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today