Azure Resource Manager
Monthly
Privilege escalation in Microsoft Azure Resource Manager (ARM) allows a remote, unauthenticated attacker to bypass authentication controls and elevate privileges across the Azure control plane. Microsoft self-reported the flaw (CWE-287) and has released a fix through the MSRC update guide; there is no public exploit identified at time of analysis, and EPSS estimates near-term exploitation likelihood at just 0.07%. Because ARM is the unified management layer for virtually all Azure resources, successful abuse could grant broad control-plane authority despite the currently low observed exploitation activity.
Privilege escalation in Microsoft Azure Resource Manager (ARM) lets a network-based attacker abuse an improper access control flaw (CWE-284) to elevate privileges and gain full read/write/impact control over resources beyond their intended authorization boundary, with a scope-changing blast radius (S:C) rated CVSS 10.0. Because ARM is the unified control-plane API that governs deployment and management of virtually all Azure resources, a successful escalation can cross tenant or subscription trust boundaries. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.05%), indicating no observed weaponization despite the maximal CVSS.
Privilege escalation in Microsoft Azure Resource Manager (ARM) allows a remote, unauthenticated attacker to bypass authentication controls and elevate privileges across the Azure control plane. Microsoft self-reported the flaw (CWE-287) and has released a fix through the MSRC update guide; there is no public exploit identified at time of analysis, and EPSS estimates near-term exploitation likelihood at just 0.07%. Because ARM is the unified management layer for virtually all Azure resources, successful abuse could grant broad control-plane authority despite the currently low observed exploitation activity.
Privilege escalation in Microsoft Azure Resource Manager (ARM) lets a network-based attacker abuse an improper access control flaw (CWE-284) to elevate privileges and gain full read/write/impact control over resources beyond their intended authorization boundary, with a scope-changing blast radius (S:C) rated CVSS 10.0. Because ARM is the unified control-plane API that governs deployment and management of virtually all Azure resources, a successful escalation can cross tenant or subscription trust boundaries. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.05%), indicating no observed weaponization despite the maximal CVSS.