Azure Web Apps
Monthly
Privilege elevation in Microsoft Azure Arc allows a remote, unauthenticated attacker to gain elevated privileges over a network by exploiting an incorrectly-resolved name or reference (CWE-706), rated the maximum CVSS 10.0 with a scope change. Reported by Microsoft with a fix available through the MSRC update guide; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Note a source conflict: the CVE description cites Azure Arc while the CPE and tags cite Azure Web Apps, so the exact affected surface should be confirmed with Microsoft.
Unauthenticated information disclosure in Azure MCP Server allows remote attackers to access sensitive data over the network without authentication. The vulnerability stems from missing authentication controls on critical functions (CWE-306), enabling attackers to bypass security boundaries and extract confidential information with minimal complexity. With CVSS 9.1 (Critical) and network-accessible attack vector requiring no privileges or user interaction, this represents a significant exposure for organizations running affected Azure MCP Server instances. No public exploit identified at time of analysis, though the straightforward authentication bypass nature increases likelihood of rapid weaponization.
An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
Privilege elevation in Microsoft Azure Arc allows a remote, unauthenticated attacker to gain elevated privileges over a network by exploiting an incorrectly-resolved name or reference (CWE-706), rated the maximum CVSS 10.0 with a scope change. Reported by Microsoft with a fix available through the MSRC update guide; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Note a source conflict: the CVE description cites Azure Arc while the CPE and tags cite Azure Web Apps, so the exact affected surface should be confirmed with Microsoft.
Unauthenticated information disclosure in Azure MCP Server allows remote attackers to access sensitive data over the network without authentication. The vulnerability stems from missing authentication controls on critical functions (CWE-306), enabling attackers to bypass security boundaries and extract confidential information with minimal complexity. With CVSS 9.1 (Critical) and network-accessible attack vector requiring no privileges or user interaction, this represents a significant exposure for organizations running affected Azure MCP Server instances. No public exploit identified at time of analysis, though the straightforward authentication bypass nature increases likelihood of rapid weaponization.
An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.