EUVD-2026-95394
GHSA-9x98-433f-w7ff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed App Service endpoint
-
DeliveryInvoke unauthenticated critical function
-
ExploitBypass missing authentication check
-
ExecutionExecute arbitrary code over network
-
ImpactCompromise hosted application and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The description specifies a missing authentication check on a critical function (CWE-306) in Azure App Service for Linux, exploitable remotely. Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or elevated privileges are required, and attack complexity is low - consistent with unauthenticated remote exploitation of a network-reachable instance. The input does not name the exact function, endpoint, or any configuration toggle that must be enabled, so the precise affected feature and whether non-default settings are required cannot be determined from the provided data. The main limiting factors are network reachability of the affected service and whether the deployed instance runs an unpatched version, since Microsoft has released an official fix. |
| Impact | All provided signals point to a genuinely high-priority flaw, with one important caveat. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N) describes the worst case: network-reachable, low-complexity, unauthenticated, no user interaction, with high confidentiality, integrity, and availability impact (9.8 Critical). The temporal metrics in the same input temper this: Exploit Code Maturity is E:U (Unproven), Remediation Level is RL:O (Official fix available), and Report Confidence is RC:C (Confirmed) - so the vulnerability itself is confirmed and patched, but no working exploit is attested in the data. No EPSS score, no CISA KEV listing, and no POC were supplied, so there is no evidence of active or imminent widespread exploitation at time of analysis. SSVC inputs (automatable, decision tree) were not provided and cannot be evaluated. The signals are therefore consistent rather than conflicting: a confirmed, patched, critically-rated missing-authentication RCE (CWE-306) in a widely used cloud platform, but currently without demonstrated exploitation. This warrants urgent patching due to the unauthenticated-RCE impact class, while recognizing that 'critical CVSS' here is not yet backed by exploitation telemetry. |
| Exploit ScenarioDerived | An unauthenticated attacker reaches an exposed Azure App Service for Linux endpoint over the network and invokes a critical function that fails to enforce authentication (CWE-306), causing attacker-supplied code to execute on the service. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required. No public proof-of-concept was provided in the intelligence, and exploit maturity is marked Unproven (E:U). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated remote code execution is possible in Microsoft Azure App Service for Linux because a critical function is exposed without any authentication check (CWE-306). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), an unauthorized attacker can reach the vulnerable functionality over the network and trigger code execution with no credentials, no user interaction, and low attack complexity, yielding high confidentiality, integrity, and availability impact (CVSS 9.8). Microsoft has published an official fix through its MSRC update guide, and no public exploit code has been identified at time of analysis; the residual risk is concentrated on internet-reachable instances still running an unpatched version. The exact function or endpoint involved is not disclosed in the available data, so operators should treat any network-exposed Azure App Service for Linux deployment as potentially affected until patched or confirmed otherwise.
RemediationAI
Apply the vendor fix documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77900; the input states patch availability from the vendor (Microsoft), and because Azure App Service is a managed platform this generally means adopting the patched platform build or redeploying affected App Service for Linux instances onto a remediated version rather than installing a customer-managed package. Until patching is confirmed, reduce exposure with compensating controls that carry explicit trade-offs: restrict inbound network access to the affected App Service using App Service access restrictions or private endpoints (blocks reachability required by the AV:N vector, but will break legitimate public-facing traffic if the service is meant to be internet-accessible), and front the service with Azure Front Door or Application Gateway with a WAF rule set (adds a hop and potential latency and requires tuning to avoid false positives, and is not a substitute for the patch). Enabling App Service Authentication / Easy Auth can add an authentication layer in front of otherwise unauthenticated functionality (mitigates the CWE-306 exposure but may break clients that cannot supply tokens, and it does not fix the underlying missing check). Because the input does not name the specific critical function or any configuration toggle, no targeted feature can be responsibly disabled; instead, prioritize inventorying Azure App Service for Linux instances, identifying which are internet-reachable and unpatched, and applying the MSRC guidance to those first. Patch status is best described as patch available per vendor advisory, with a vendor-released patch referenced through the MSRC update guide.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-306, Missing Authentication for Critical Function, which means the affected component performs a sensitive operation but fails to verify that the caller is authorized before doing so. In an Azure App Service for Linux context the impact escalates because the unauthenticated operation is one that can lead to arbitrary code execution rather than mere information disclosure. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a network-reachable attack path with no privileges (PR:N) and no user interaction (UI:N), and the scope is unchanged (S:U), so the attacker's impact stays within the App Service trust boundary rather than automatically pivoting to other cloud tenants. The provided CPE string cpe:2.3:a:microsoft:azure_app_service_for_linux:*:*:*:*:*:*:*:* uses a wildcard version, indicating Microsoft classifies the platform component broadly rather than pinning a single build; the vendor's own CPE for the Linux flavor is the only affected product identifier supplied. Because the platform is Microsoft-managed, the vulnerable code lives in the service fabric rather than solely in customer application code, which is why remediation is tied to Microsoft's platform fix instead of a customer-supplied library upgrade. Notably, the input does not identify the specific critical function, route, or configuration flag involved, and it does not state whether non-default settings are required, so the precise attack surface cannot be narrowed further from the available evidence.
Know when Azure App Service For Linux gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Missing authentication on a critical function permits unauthenticated network RCE (AV:N/AC:L/PR:N/UI:N) with full code execution yielding high C/I/A; scope unchanged absent evidence of crossing a security boundary.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
Technical POC Analysis
The supplied evidence identifies the bug class as CWE-306, Missing Authentication for Critical Function.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Microsoft Azure App Service for Linux deployments, especially internet-reachable instances, face a critical unauthenticated remote code execution risk from CVE-2026-77900 that can allow attackers to run code without credentials or user interaction. Because hosted workloads could suffer high confidentiality, integrity, and availability impact, leadership should treat exposed Linux App Service environments as an urgent remediation priority until the vendor fix is confirmed. No public exploit has been identified at time of analysis, but the unauthenticated attack path and critical severity warrant immediate patch validation and exposure reduction.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB