Azure
Monthly
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate privileges over the network, potentially achieving full control over database resources. With a critical CVSS score of 9.9 due to scope change and high impact, the flaw requires a valid low-privileged identity to exploit; no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full compromise of confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) by abusing insufficient verification of data authenticity (CWE-345); publicly available exploit code exists, yet CISA's SSVC framework currently records Exploitation as none. Signals therefore conflict and must be weighed carefully: the flaw is rated critical and marked Automatable with Technical Impact total, but EPSS is low at 0.32% (25th percentile) and there is no KEV listing confirming active exploitation. Because Azure Billing is a Microsoft-hosted cloud service, customer-side exposure depends on Microsoft's server-side remediation rather than on local deployment choices, and the description names no specific feature, endpoint, or configuration prerequisite.
Privilege elevation in Microsoft Azure Cosmos DB allows an attacker who already holds valid low-level authorization to a Cosmos DB account or service to exploit an injection flaw (CWE-74) and reach a downstream component with improperly neutralized special elements, escalating privileges over the network. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) - network-reachable, low complexity, no user interaction, but gated behind existing authorization, with a scope change (S:C) driving the Critical rating despite the absence of an availability impact. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; because Cosmos DB is a Microsoft-managed cloud service, remediation is applied server-side and the exploitable window is controlled by Microsoft rather than persisting until customers patch.
Unauthenticated remote attackers can reach a critical function inside Microsoft Azure AI Foundry that performs a privileged operation without any authentication check, giving high confidentiality, integrity and availability impact across the affected service (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, CWE-306). The weakness lives in a Microsoft-operated cloud service rather than a customer-installable product, so both the exposed surface and the fix are controlled server-side by Microsoft and the specific impacted feature is not publicly disclosed. Exploitation signals currently conflict: no public exploit code has been identified and CISA's SSVC rates exploitation as 'none' (automatable: yes, technical impact: total) with a low EPSS of 0.49% (41st percentile), yet the unauthenticated, no-user-interaction path makes the bug trivially automatable once technical details circulate.
Improper access control in Microsoft Azure Logic Apps allows an unauthenticated remote attacker to elevate privileges over the network, gaining high confidentiality and integrity impact against the affected service. The flaw rates CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning the vector assumes no privileges and no user interaction are needed, though Microsoft's use of "elevate privileges" in the description hints that some pre-existing tenant or service context may be required - a discrepancy worth verifying against the MSRC advisory. There is no public exploit identified at time of analysis: EPSS is 0.45% (39th percentile), CISA SSVC records exploitation as "none," and no KEV listing exists, but SSVC rates the issue fully automatable with total technical impact.
Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restricted directory and elevate privileges over the network, with the vendor's CVSS 9.8 score reflecting high confidentiality, integrity, and availability impact under a PR:N/UI:N vector. The defect affects the hosted Azure Logic Apps service rather than a versioned on-premises component, and Microsoft's advisory does not disclose the specific endpoint, feature, or configuration that must be reachable, so the precise triggering surface remains undocumented. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation (Exploitation: none) while flagging the issue as automatable with total technical impact; EPSS sits at 0.58% (47th percentile), indicating low modeled near-term exploitation likelihood despite the critical base score. Because Logic Apps is a Microsoft-managed cloud service, exposure depends on whether a given tenant region or service instance was remediated centrally rather than on any customer-side patch action.
Information disclosure in Microsoft Azure Machine Learning allows unauthenticated network attackers to read sensitive data via an incorrect authorization check (CWE-863). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) indicates a remote, low-complexity attack requiring no privileges or user interaction, with high confidentiality impact but no integrity or availability impact. No public exploit code has been identified at time of analysis, and EPSS is low at 0.55% (45th percentile); Microsoft hosts the service and deploys fixes server-side, so no customer patch is required, though Microsoft's 'unauthorized attacker' wording may mask a need for some tenant access-verify with the vendor.
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Azure IoT Explorer fails to properly restrict communication to intended endpoints, enabling unauthenticated attackers to intercept and disclose sensitive information over the network. The vulnerability requires no user interaction and can be exploited remotely with a CVSS score of 7.5. A patch is available for affected Azure IoT products.
Azure IoT Explorer fails to enforce authentication on a critical function, enabling unauthenticated network attackers to remotely access and exfiltrate sensitive information. This high-severity vulnerability (CVSS 7.5) affects Azure IoT deployments and requires immediate patching to prevent unauthorized disclosure of IoT configuration and operational data. A patch is available.
Sensitive data transmission over cleartext in Azure IoT Explorer enables network-based attackers to intercept and disclose confidential information without authentication. This vulnerability affects Azure IoT deployments and could expose device credentials, configuration details, or other sensitive metadata to passive network observers. A patch is available to remediate the cleartext transmission issue.
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
tfplan2md versions before 1.26.1 fail to properly mask sensitive values in Terraform plan reports across multiple rendering paths, causing credentials and other confidential data to be exposed in plaintext markdown output instead of being redacted. Administrators and developers using affected versions to generate infrastructure reports may inadvertently expose secrets to unauthorized parties with access to the generated documentation. No patch is currently available for this high-severity information disclosure vulnerability affecting Azure and Terraform workflows.
Configuration deletion and resource denial in StorageGRID versions before 11.9.0.12 and 12.0.0.4 stems from an SSRF flaw in Microsoft Entra ID SSO integration, allowing authenticated attackers to manipulate backend requests. Successful exploitation enables deletion of configuration data or denial of access to storage resources despite requiring valid credentials to initiate the attack.
Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
Remote code execution in Azure Local stems from improper certificate validation, enabling unauthenticated attackers to execute arbitrary code over the network without user interaction. This HIGH severity vulnerability (CVSS 8.1) affects Azure and Azure Local deployments, with no patch currently available. Organizations using these products face immediate risk of compromise through network-based attacks exploiting this validation bypass.
Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud service vulnerability affecting CDN/WAF infrastructure.
Azure Function Information Disclosure Vulnerability [CVSS 8.2 HIGH]
Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate privileges through the CDN and WAF infrastructure.
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permissions within the identity platform.
Azure Data Explorer exposes sensitive information to unauthenticated remote attackers through a network-accessible vulnerability requiring only user interaction. An attacker can retrieve confidential data without authorization, potentially compromising customer information stored in affected Azure deployments. No patch is currently available for this high-severity vulnerability.
Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevated access without authentication or user interaction. Organizations using Azure Logic Apps are at risk of unauthorized privilege elevation through network-based attacks, with no available patch currently provided.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware on managed devices across the fleet.
Remote code execution in Azure Core Shared Client Library for Python results from insecure deserialization of untrusted data, allowing authenticated network-based attackers to achieve arbitrary code execution. The vulnerability affects Python applications utilizing the vulnerable library versions, with no patch currently available. This represents a high-severity risk for Azure SDK consumers handling external or user-supplied serialized data.
Local privilege escalation in Azure Connected Machine Agent exploits a stack-based buffer overflow, enabling authenticated users to gain elevated system privileges. The vulnerability affects Azure and Stack Overflow deployments and requires local access with valid credentials to exploit. No patch is currently available for this high-severity issue.
Cross-site scripting in the hosted Microsoft Azure Portal (CVE-2026-83946) allows an unauthenticated attacker to have malicious script rendered inside the privileged portal origin, escaping into a trusted administrative context once an authenticated portal user (typically an administrator) loads or clicks attacker-controlled content. The vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N rates this 8.2 (High), driven chiefly by the scope change (S:C) and high confidentiality impact (C:H) - meaning injected script can read data across the portal origin - with the required victim interaction (UI:R) as the main limiting factor. No CISA KEV listing and no public exploit code was identified at time of analysis, and because Azure Portal is a Microsoft-operated service, the issue was remediated server-side, so no customer patch or upgrade exists or is needed.
KQL injection in kafka-sink-azure-kusto Kafka Connect plugin prior to 5.2.3 allows authenticated administrators with Kafka Connect configuration permissions to inject arbitrary KQL management commands by embedding metacharacters in the kusto.tables.topics.mapping configuration fields (db, table, mapping, format). An attacker with connector configuration privileges could enumerate or modify schemas, tamper with ingestion mappings, or alter streaming and retention policies on the target Azure Data Explorer database using the connector's service principal credentials. The vulnerability is fixed in version 5.2.3 and has not been observed in active exploitation at the time of this analysis.
Confidential Sidecar Containers is affected by cleartext storage of sensitive information (CVSS 6.5).
Azure HDInsight contains a cross-site scripting (XSS) vulnerability in web page generation that allows authenticated attackers to conduct spoofing attacks over the network. An attacker with valid credentials and user interaction can exploit this weakness to manipulate web content and deceive users. No patch is currently available for this issue.
Azure IoT Explorer binds to unrestricted IP addresses, enabling unauthenticated remote attackers to intercept and disclose sensitive information over the network. This vulnerability affects Azure IoT deployments where the Explorer tool is exposed without proper network segmentation. No patch is currently available, making network isolation the primary mitigation strategy.
Azure Compute Gallery contains a command injection vulnerability that enables authorized users to execute arbitrary commands with elevated privileges on local systems. The flaw requires high-level privileges to exploit and affects confidentiality, integrity, and availability of the target system. No patch is currently available.
Authenticated users of Azure and Azure DevOps Server can exploit a server-side request forgery vulnerability to perform network-based spoofing attacks. This MEDIUM severity issue (CVSS 6.5) requires valid credentials but allows attackers to manipulate the server into making unauthorized requests, potentially compromising confidentiality. No patch is currently available.
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package directory by exploiting incomplete path normalization that fails to block backslash-based traversal sequences. Public exploit code exists for this vulnerability, which affects Windows developers and CI/CD pipelines (GitHub Actions, Azure DevOps) and could result in overwriting sensitive configuration files like .npmrc or build configurations. A patch is available in pnpm version 10.28.1 and later.
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate privileges over the network, potentially achieving full control over database resources. With a critical CVSS score of 9.9 due to scope change and high impact, the flaw requires a valid low-privileged identity to exploit; no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full compromise of confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) by abusing insufficient verification of data authenticity (CWE-345); publicly available exploit code exists, yet CISA's SSVC framework currently records Exploitation as none. Signals therefore conflict and must be weighed carefully: the flaw is rated critical and marked Automatable with Technical Impact total, but EPSS is low at 0.32% (25th percentile) and there is no KEV listing confirming active exploitation. Because Azure Billing is a Microsoft-hosted cloud service, customer-side exposure depends on Microsoft's server-side remediation rather than on local deployment choices, and the description names no specific feature, endpoint, or configuration prerequisite.
Privilege elevation in Microsoft Azure Cosmos DB allows an attacker who already holds valid low-level authorization to a Cosmos DB account or service to exploit an injection flaw (CWE-74) and reach a downstream component with improperly neutralized special elements, escalating privileges over the network. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) - network-reachable, low complexity, no user interaction, but gated behind existing authorization, with a scope change (S:C) driving the Critical rating despite the absence of an availability impact. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; because Cosmos DB is a Microsoft-managed cloud service, remediation is applied server-side and the exploitable window is controlled by Microsoft rather than persisting until customers patch.
Unauthenticated remote attackers can reach a critical function inside Microsoft Azure AI Foundry that performs a privileged operation without any authentication check, giving high confidentiality, integrity and availability impact across the affected service (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, CWE-306). The weakness lives in a Microsoft-operated cloud service rather than a customer-installable product, so both the exposed surface and the fix are controlled server-side by Microsoft and the specific impacted feature is not publicly disclosed. Exploitation signals currently conflict: no public exploit code has been identified and CISA's SSVC rates exploitation as 'none' (automatable: yes, technical impact: total) with a low EPSS of 0.49% (41st percentile), yet the unauthenticated, no-user-interaction path makes the bug trivially automatable once technical details circulate.
Improper access control in Microsoft Azure Logic Apps allows an unauthenticated remote attacker to elevate privileges over the network, gaining high confidentiality and integrity impact against the affected service. The flaw rates CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning the vector assumes no privileges and no user interaction are needed, though Microsoft's use of "elevate privileges" in the description hints that some pre-existing tenant or service context may be required - a discrepancy worth verifying against the MSRC advisory. There is no public exploit identified at time of analysis: EPSS is 0.45% (39th percentile), CISA SSVC records exploitation as "none," and no KEV listing exists, but SSVC rates the issue fully automatable with total technical impact.
Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restricted directory and elevate privileges over the network, with the vendor's CVSS 9.8 score reflecting high confidentiality, integrity, and availability impact under a PR:N/UI:N vector. The defect affects the hosted Azure Logic Apps service rather than a versioned on-premises component, and Microsoft's advisory does not disclose the specific endpoint, feature, or configuration that must be reachable, so the precise triggering surface remains undocumented. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation (Exploitation: none) while flagging the issue as automatable with total technical impact; EPSS sits at 0.58% (47th percentile), indicating low modeled near-term exploitation likelihood despite the critical base score. Because Logic Apps is a Microsoft-managed cloud service, exposure depends on whether a given tenant region or service instance was remediated centrally rather than on any customer-side patch action.
Information disclosure in Microsoft Azure Machine Learning allows unauthenticated network attackers to read sensitive data via an incorrect authorization check (CWE-863). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) indicates a remote, low-complexity attack requiring no privileges or user interaction, with high confidentiality impact but no integrity or availability impact. No public exploit code has been identified at time of analysis, and EPSS is low at 0.55% (45th percentile); Microsoft hosts the service and deploys fixes server-side, so no customer patch is required, though Microsoft's 'unauthorized attacker' wording may mask a need for some tenant access-verify with the vendor.
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Azure IoT Explorer fails to properly restrict communication to intended endpoints, enabling unauthenticated attackers to intercept and disclose sensitive information over the network. The vulnerability requires no user interaction and can be exploited remotely with a CVSS score of 7.5. A patch is available for affected Azure IoT products.
Azure IoT Explorer fails to enforce authentication on a critical function, enabling unauthenticated network attackers to remotely access and exfiltrate sensitive information. This high-severity vulnerability (CVSS 7.5) affects Azure IoT deployments and requires immediate patching to prevent unauthorized disclosure of IoT configuration and operational data. A patch is available.
Sensitive data transmission over cleartext in Azure IoT Explorer enables network-based attackers to intercept and disclose confidential information without authentication. This vulnerability affects Azure IoT deployments and could expose device credentials, configuration details, or other sensitive metadata to passive network observers. A patch is available to remediate the cleartext transmission issue.
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
tfplan2md versions before 1.26.1 fail to properly mask sensitive values in Terraform plan reports across multiple rendering paths, causing credentials and other confidential data to be exposed in plaintext markdown output instead of being redacted. Administrators and developers using affected versions to generate infrastructure reports may inadvertently expose secrets to unauthorized parties with access to the generated documentation. No patch is currently available for this high-severity information disclosure vulnerability affecting Azure and Terraform workflows.
Configuration deletion and resource denial in StorageGRID versions before 11.9.0.12 and 12.0.0.4 stems from an SSRF flaw in Microsoft Entra ID SSO integration, allowing authenticated attackers to manipulate backend requests. Successful exploitation enables deletion of configuration data or denial of access to storage resources despite requiring valid credentials to initiate the attack.
Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
Remote code execution in Azure Local stems from improper certificate validation, enabling unauthenticated attackers to execute arbitrary code over the network without user interaction. This HIGH severity vulnerability (CVSS 8.1) affects Azure and Azure Local deployments, with no patch currently available. Organizations using these products face immediate risk of compromise through network-based attacks exploiting this validation bypass.
Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud service vulnerability affecting CDN/WAF infrastructure.
Azure Function Information Disclosure Vulnerability [CVSS 8.2 HIGH]
Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate privileges through the CDN and WAF infrastructure.
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permissions within the identity platform.
Azure Data Explorer exposes sensitive information to unauthenticated remote attackers through a network-accessible vulnerability requiring only user interaction. An attacker can retrieve confidential data without authorization, potentially compromising customer information stored in affected Azure deployments. No patch is currently available for this high-severity vulnerability.
Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevated access without authentication or user interaction. Organizations using Azure Logic Apps are at risk of unauthorized privilege elevation through network-based attacks, with no available patch currently provided.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware on managed devices across the fleet.
Remote code execution in Azure Core Shared Client Library for Python results from insecure deserialization of untrusted data, allowing authenticated network-based attackers to achieve arbitrary code execution. The vulnerability affects Python applications utilizing the vulnerable library versions, with no patch currently available. This represents a high-severity risk for Azure SDK consumers handling external or user-supplied serialized data.
Local privilege escalation in Azure Connected Machine Agent exploits a stack-based buffer overflow, enabling authenticated users to gain elevated system privileges. The vulnerability affects Azure and Stack Overflow deployments and requires local access with valid credentials to exploit. No patch is currently available for this high-severity issue.
Cross-site scripting in the hosted Microsoft Azure Portal (CVE-2026-83946) allows an unauthenticated attacker to have malicious script rendered inside the privileged portal origin, escaping into a trusted administrative context once an authenticated portal user (typically an administrator) loads or clicks attacker-controlled content. The vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N rates this 8.2 (High), driven chiefly by the scope change (S:C) and high confidentiality impact (C:H) - meaning injected script can read data across the portal origin - with the required victim interaction (UI:R) as the main limiting factor. No CISA KEV listing and no public exploit code was identified at time of analysis, and because Azure Portal is a Microsoft-operated service, the issue was remediated server-side, so no customer patch or upgrade exists or is needed.
KQL injection in kafka-sink-azure-kusto Kafka Connect plugin prior to 5.2.3 allows authenticated administrators with Kafka Connect configuration permissions to inject arbitrary KQL management commands by embedding metacharacters in the kusto.tables.topics.mapping configuration fields (db, table, mapping, format). An attacker with connector configuration privileges could enumerate or modify schemas, tamper with ingestion mappings, or alter streaming and retention policies on the target Azure Data Explorer database using the connector's service principal credentials. The vulnerability is fixed in version 5.2.3 and has not been observed in active exploitation at the time of this analysis.
Confidential Sidecar Containers is affected by cleartext storage of sensitive information (CVSS 6.5).
Azure HDInsight contains a cross-site scripting (XSS) vulnerability in web page generation that allows authenticated attackers to conduct spoofing attacks over the network. An attacker with valid credentials and user interaction can exploit this weakness to manipulate web content and deceive users. No patch is currently available for this issue.
Azure IoT Explorer binds to unrestricted IP addresses, enabling unauthenticated remote attackers to intercept and disclose sensitive information over the network. This vulnerability affects Azure IoT deployments where the Explorer tool is exposed without proper network segmentation. No patch is currently available, making network isolation the primary mitigation strategy.
Azure Compute Gallery contains a command injection vulnerability that enables authorized users to execute arbitrary commands with elevated privileges on local systems. The flaw requires high-level privileges to exploit and affects confidentiality, integrity, and availability of the target system. No patch is currently available.
Authenticated users of Azure and Azure DevOps Server can exploit a server-side request forgery vulnerability to perform network-based spoofing attacks. This MEDIUM severity issue (CVSS 6.5) requires valid credentials but allows attackers to manipulate the server into making unauthorized requests, potentially compromising confidentiality. No patch is currently available.
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package directory by exploiting incomplete path normalization that fails to block backslash-based traversal sequences. Public exploit code exists for this vulnerability, which affects Windows developers and CI/CD pipelines (GitHub Actions, Azure DevOps) and could result in overwriting sensitive configuration files like .npmrc or build configurations. A patch is available in pnpm version 10.28.1 and later.
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.