CVE-2025-24986: Azure Promptflow Remote Code Execution Vulnerability

Overview

Severity
Medium (CVSS 6.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2025-Mar
Released
2025-03-11
EPSS Score
0.57% (percentile: 68.7%)

Description

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.

FAQ

According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L), and integrity (I:L) but lead to no loss of availability (A:N). What is the impact of this vulnerability? While an attacker can access some data, that data is not customer’s data, or any highly sensitive/critical information; furthermore an attacker cannot affect the availability of the product.

Affected Products (2)

Azure

  • Azure promptflow-core
  • Azure promptflow-tools

Security Updates (2)

Acknowledgments

l1k3beef

Revision History

  • 2025-03-11: Information published.