Azure Portal
Monthly
Information disclosure in Microsoft Azure Portal allows a remote, unauthenticated attacker to access sensitive data they are not authorized to view by exploiting an improper authorization check (CWE-285) reachable over the network. The flaw affects the cloud-hosted Azure management console and, per its CVSS vector, requires no privileges or user interaction while yielding high confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the issue is assessed as automatable; the EPSS probability is modest at 1.03%.
Azure Portal Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Information disclosure in Microsoft Azure Portal allows a remote, unauthenticated attacker to access sensitive data they are not authorized to view by exploiting an improper authorization check (CWE-285) reachable over the network. The flaw affects the cloud-hosted Azure management console and, per its CVSS vector, requires no privileges or user interaction while yielding high confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the issue is assessed as automatable; the EPSS probability is modest at 1.03%.
Azure Portal Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.