Azure Virtual Network Gateway
Monthly
Remote code execution in Microsoft Azure Virtual Network Gateway allows an authenticated attacker to run arbitrary code over the network by supplying malformed input that the service fails to validate (CWE-20). Any low-privileged principal with network access to the gateway can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.09% 30-day exploitation probability, but the CVSS 8.8 and 'total' technical impact keep it a meaningful priority.
Remote code execution in Microsoft Azure Virtual Network Gateway allows an authenticated attacker to run arbitrary code over the network by supplying malformed input that the service fails to validate (CWE-20). Any low-privileged principal with network access to the gateway can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.09% 30-day exploitation probability, but the CVSS 8.8 and 'total' technical impact keep it a meaningful priority.