Azure Notification Service
Monthly
Improper access control in Microsoft's Azure Notification Service lets an already-authorized, low-privileged principal bypass authorization boundaries and elevate privileges over the network, with full impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, HIGH). The exploit path requires only low privileges (PR:L), low complexity (AC:L), and no user interaction (UI:N), so any tenant or service principal with legitimate but limited access is a potential launching point; anonymous outsiders cannot exploit it. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score of 0.55% (44th percentile) reflects low near-term exploitation likelihood. Because this is a Microsoft-hosted cloud service, the fix is applied server-side by Microsoft rather than requiring customer patching.
Improper access control in Microsoft's Azure Notification Service lets an already-authorized, low-privileged principal bypass authorization boundaries and elevate privileges over the network, with full impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8, HIGH). The exploit path requires only low privileges (PR:L), low complexity (AC:L), and no user interaction (UI:N), so any tenant or service principal with legitimate but limited access is a potential launching point; anonymous outsiders cannot exploit it. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score of 0.55% (44th percentile) reflects low near-term exploitation likelihood. Because this is a Microsoft-hosted cloud service, the fix is applied server-side by Microsoft rather than requiring customer patching.