Azure Event Grid EUVD-2026-95396

Exploitation requires the attacker to already hold a valid, low-privilege authorized identity within the Azure environment (CVSS PR:L) - it is NOT remote-unauthenticated. The core condition is the missing authorization check (CWE-862) in Azure Event Grid, which lets an authenticated principal perform event publishing/routing actions across an authorization boundary they should not cross, enabling spoofing of trusted event sources. Limiting factors that reduce real-world risk: valid Azure authentication is mandatory, no user interaction is involved but the attacker must have network access to the Event Grid endpoint, and because it is a Microsoft-managed cloud service the fix is applied server-side by the vendor rather than requiring customer action. Impact is integrity-only (C:N/A:N) - no data disclosure or denial of service.

This is a genuine but conditional priority, not an inflated high-CVSS issue. The CVSS 3.1 base vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) describes a low-complexity, network-reachable integrity attack that requires some pre-existing authorization (PR:L) and no user interaction, with a scope change (S:C) indicating impact beyond the vulnerable component - consistent with Event Grid forwarding spoofed events to downstream consumers. The temporal metrics are telling and internally consistent: E:U (Unproven exploit), RL:O (Official fix available), RC:C (Confirmed) - meaning Microsoft has confirmed and patched the flaw but no exploit is known. There is NO EPSS score, NO CISA KEV listing, and NO POC in the provided data, so exploitation is currently theoretical. Signals align rather than conflict: a vendor-confirmed, patched, authenticated spoofing flaw with no evidence of weaponization. The main caveat is the gap between a 'missing authorization' / spoofing mechanism and the PR:L rating - defenders should confirm with Microsoft exactly which Azure role or scope an attacker needs, since that determines whether this is cross-tenant/cross-resource or merely within an already-trusted boundary.

An attacker holding a low-privilege but valid Azure identity abuses a missing authorization check in Azure Event Grid to publish or route events they should not be allowed to, impersonating a trusted event source. Downstream subscribers and handlers that trust Event Grid-delivered events then process forged messages as legitimate. No public exploit code has been identified at time of analysis, and the CVSS exploit maturity is Unproven (E:U).