CVE-2025-21199

Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability

Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Agent Azure Agent For Backup Azure Agent For Site Recovery

CVE-2025-24986

Azure Promptflow Remote Code Execution Vulnerability

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Promptflow Core Azure Promptflow Tools

CVE-2025-29819

Windows Admin Center in Azure Portal Information Disclosure Vulnerability

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 6.2 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Azure Portal Windows Admin Center Windows Admin Center

CVE-2025-27489

Azure Local Elevation of Privilege Vulnerability

Improper input validation in Azure Local allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Stack Hci 22h2 Azure Stack Hci 23h2 Azure Stack Hci Os 22h2 and 1 more

CVE-2025-26628

Azure Local Cluster Information Disclosure Vulnerability

Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally.

CVSS 3.1 · 7.3 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Azure Azure Local Azure Local Cluster

CVE-2025-25002

Azure Local Cluster Information Disclosure Vulnerability

Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network.

CVSS 3.1 · 6.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Azure Local Cluster

CVE-2025-29827

Azure Automation Elevation of Privilege Vulnerability

Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS 1.5% KEV · Not listed

Vendors

Microsoft

Products

Azure Automation

CVE-2025-30387

Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Azure Ai Document Intelligence Studio

CVE-2025-21195

Azure Service Fabric Runtime Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Azure Microsoft

Products

Service Fabric Azure Service Fabric Service Fabric

CVE-2025-53793

Azure Stack Hub Information Disclosure Vulnerability

Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Microsoft

Products

Azure Stack Hub Azure Stack Hub 2406 Azure Stack Hub 2408 and 1 more

CVE-2025-53765

Azure Stack Hub Information Disclosure Vulnerability

Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure App Service On Azure Stack Azure Stack Hub

CVE-2025-53781

Azure Virtual Machines Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 7.7 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

Dcadsv5 Series Azure Vm Dcasv5 Series Azure Vm Dcedsv5 Series Azure Vm and 31 more

CVE-2023-36419

Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability

Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsight

CVE-2023-23408

Azure Apache Ambari Spoofing Vulnerability

Azure Apache Ambari Spoofing Vulnerability

CVSS 3.1 · 4.5 Medium EPSS 4.0% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsight Azure Hdinsights

CVE-2023-38156

Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability

Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability

CVSS 3.1 · 7.2 High EPSS 2.0% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsight

CVE-2023-35393

Azure Apache Hive Spoofing Vulnerability

Azure Apache Hive Spoofing Vulnerability

CVSS 3.1 · 4.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsight Azure Hdinsights

CVE-2023-35394

Azure HDInsight Jupyter Notebook Spoofing Vulnerability

Azure HDInsight Jupyter Notebook Spoofing Vulnerability

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsight Azure Hdinsights

CVE-2023-36881

Azure Apache Ambari Spoofing Vulnerability

Azure Apache Ambari Spoofing Vulnerability

CVSS 3.1 · 4.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsight Azure Hdinsights

CVE-2023-36877

Azure Apache Oozie Spoofing Vulnerability

Azure Apache Oozie Spoofing Vulnerability

CVSS 3.1 · 4.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsight Azure Hdinsights

CVE-2023-38188

Azure Apache Hadoop Spoofing Vulnerability

Azure Apache Hadoop Spoofing Vulnerability

CVSS 3.1 · 4.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsight Azure Hdinsights