Azure Billing
Monthly
Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full compromise of confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) by abusing insufficient verification of data authenticity (CWE-345); publicly available exploit code exists, yet CISA's SSVC framework currently records Exploitation as none. Signals therefore conflict and must be weighed carefully: the flaw is rated critical and marked Automatable with Technical Impact total, but EPSS is low at 0.32% (25th percentile) and there is no KEV listing confirming active exploitation. Because Azure Billing is a Microsoft-hosted cloud service, customer-side exposure depends on Microsoft's server-side remediation rather than on local deployment choices, and the description names no specific feature, endpoint, or configuration prerequisite.
Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full compromise of confidentiality, integrity, and availability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) by abusing insufficient verification of data authenticity (CWE-345); publicly available exploit code exists, yet CISA's SSVC framework currently records Exploitation as none. Signals therefore conflict and must be weighed carefully: the flaw is rated critical and marked Automatable with Technical Impact total, but EPSS is low at 0.32% (25th percentile) and there is no KEV listing confirming active exploitation. Because Azure Billing is a Microsoft-hosted cloud service, customer-side exposure depends on Microsoft's server-side remediation rather than on local deployment choices, and the description names no specific feature, endpoint, or configuration prerequisite.