Azure Event Grid
Monthly
Azure Event Grid, Microsoft's fully managed event-routing service, can be abused by unauthenticated remote attackers to elevate privileges with high impact across confidentiality, integrity, and availability, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - no credentials or user interaction are required and attack complexity is low. The root cause is improper access control (CWE-284) in the service's own authorization logic; because Event Grid is a multi-tenant cloud PaaS, any fix is applied centrally by Microsoft rather than by customers, which substantially narrows the real-world exposure window. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.38% (30th percentile), so the 9.8 base score overstates near-term exploitation likelihood; an independent assessment confirms the primary limiting factor is the cloud-managed deployment model, and the exact starting trust level implied by 'elevate privileges' remains ambiguous in the available data.
Azure Event Grid, Microsoft's fully managed event-routing service, can be abused by unauthenticated remote attackers to elevate privileges with high impact across confidentiality, integrity, and availability, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - no credentials or user interaction are required and attack complexity is low. The root cause is improper access control (CWE-284) in the service's own authorization logic; because Event Grid is a multi-tenant cloud PaaS, any fix is applied centrally by Microsoft rather than by customers, which substantially narrows the real-world exposure window. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.38% (30th percentile), so the 9.8 base score overstates near-term exploitation likelihood; an independent assessment confirms the primary limiting factor is the cloud-managed deployment model, and the exact starting trust level implied by 'elevate privileges' remains ambiguous in the available data.