Azure Compute Resource Provider
Monthly
Server-side request forgery in Microsoft's cloud-hosted Azure Compute Gallery allows unauthenticated remote attackers to coerce the Azure Compute Resource Provider into issuing attacker-influenced requests, ultimately elevating privileges within the service. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), exploitation is network-reachable, low complexity, requires no authentication and no user interaction, and yields high confidentiality and integrity impact; the scope is unchanged. There is confirmed no public exploit code and no CISA KEV listing at time of analysis - no public exploit identified at time of analysis - and the EPSS score is modest at 0.77% (54th percentile), reflecting that the primary constraint is operational: the target is a Microsoft-operated multi-tenant service remediated centrally by Microsoft, not by customer patch deployment.
Server-side request forgery in Microsoft's cloud-hosted Azure Compute Gallery allows unauthenticated remote attackers to coerce the Azure Compute Resource Provider into issuing attacker-influenced requests, ultimately elevating privileges within the service. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), exploitation is network-reachable, low complexity, requires no authentication and no user interaction, and yields high confidentiality and integrity impact; the scope is unchanged. There is confirmed no public exploit code and no CISA KEV listing at time of analysis - no public exploit identified at time of analysis - and the EPSS score is modest at 0.77% (54th percentile), reflecting that the primary constraint is operational: the target is a Microsoft-operated multi-tenant service remediated centrally by Microsoft, not by customer patch deployment.