Azure Service Bus
Monthly
Remote code execution in Microsoft Azure Service Bus lets an already-authorized (PR:L) attacker send maliciously crafted serialized data that the service deserializes without validation (CWE-502), executing attacker-controlled code across the network. The scope-changed CVSS 9.9 rating reflects that code execution can break out of the caller's authorization boundary into the underlying managed-service host, threatening confidentiality, integrity, and availability of the messaging infrastructure. There is no public exploit identified at time of analysis, but the near-maximal severity and cloud-hosted, multi-tenant nature of the platform make this a high-priority issue.
Remote code execution in Microsoft Azure Service Bus lets an already-authorized (PR:L) attacker send maliciously crafted serialized data that the service deserializes without validation (CWE-502), executing attacker-controlled code across the network. The scope-changed CVSS 9.9 rating reflects that code execution can break out of the caller's authorization boundary into the underlying managed-service host, threatening confidentiality, integrity, and availability of the messaging infrastructure. There is no public exploit identified at time of analysis, but the near-maximal severity and cloud-hosted, multi-tenant nature of the platform make this a high-priority issue.